Delete an existing JWT cookie if using HTTP.

SessionResponse wraps the created token or returns an empty string if deleted.