This moves the body status decision to h2_end_headers, to make sure that
it is only done once per request.

We also move the Cookie header concatenation to h2_end_headers, to avoid
stepping on any changes that may have taken place in VCL.

Fixes: #2305