Add a "session" cookie to the REST endpoint to help sticky-session load-balancers

To help load-balancers handle the multi-request HTTP authentication mechanisms (such as DIGEST), we should return a "Set-Cookie" header when accessing secure resources.

The cookie name is "ISPN_SESSION". Its content is random and does not affect the actual authentication.