set req.http.Cookie = req.http.Cookie + " " + req.http.Cookie-sess;

do the obvious thing, even if req.http.Cookie does not exist.

The underlying issue was a badly though through overloading of
the NULL value to mean "Unset".  Now it has its own magic marker.

Fixes #1218