Take into account multiple Set-Cookie headers in logDebugResponseCookie

[kaaloo]

While investigating a lost session on login issue, I came across this issue in trace level debugging. Our app which uses Apache Shiro is currently sending out two Set-Cookie headers, one for deleting a remember me cookie and one for setting the JSESSIONID. The current code doesn't always emit a log entry in logDebugResponseCookie presumably because which of these headers is actually processed is non-deterministic. This small patch will go through all Set-Cookie headers and emit a log entry for each session cookie.

[magro]

Thanks for the PR! How urgent is a release for you?

[kaaloo]

Sorry for the long delay! Just getting to this during the holidays. There is no urgency, we are using a patched jar. Thanks for asking!