Session endpoint should expire the session cookie

The session end-point logs the user out in response to a DELETE request. However, this is done by simply calling Context.logout(). While Context.logout() kills the user session as tracked internally by the application, it does not actually end the web session by calling httpSession.invalidate(). This means that the user's browser can still think it has a valid session, even though on the OpenMRS side the user does not.