Persist session and cookies set on result

[andrew-nowak]

Currently, in most code paths the filter constructs a new Result object with updated body and headers, which means that any new session or cookies previously set on the result will be dropped. The impact of this can currently be seen on the CV redact tool, which cannot pass CSRF checks because the session is never sent to the user's browser, so the CSRF token sent with the submission cannot be verified.

Instead, copy the Result to insert the updated headers and body without dropping other values set on the Result.

[mchv]

@andrew-nowak Sorry, I missed this notification!
I will have a look now

[mchv]

Thank you @andrew-nowak! I was curious about the issue and I found the following:

• Initial implementation had this issue from the beginning as this was inherited from the play Gzip filter implementation at that time.
• This was fixed in the Gzip filter about 7 year ago! Sadly I did not noticed it and picked it up at that time.

[mchv]

I have just shipped 0.15.2 with the fix.