Remove set-cookie header on custom.css

[tribela]

/custom.css intended to be cached, But was not cached by nginx, cdn because it has Set-Cookie header.
This commit will fix that problem.

[ClearlyClaire]

This does not seem to actually work. I think I already had investigated session_options[:skip] in the past and it only worked with Rails 4?
In any case, I'm currently investigating why a session is accessed at all in the first place in this controller.

[ClearlyClaire]

ok so, session_options[:skip] does kind of work, except it does not prevent a request with the _session_id cookie from having that cookie sent back for some reason.

Cookies are initially set because of the Localized concern, so adding skip_around_action :set_locale should help. I'd also add a test in the testsuite to ensure no cookies are set from an anonymous request.

Now, because of the _session_id stuff, most requests will probably have a cookie anyway, still looking into how to get rid of that…

EDIT: found why the _session_id cookie was sent, see next message

[ClearlyClaire]

Adding the following avoids a session cookie being sent in all cases:

  skip_before_action :update_user_sign_in
  skip_before_action :set_session_activity
  skip_around_action :set_locale

At this point, we may want to have the controller use another base controller class entirely, but this should be enough for the time being. More generally, we might want to review all controllers to ensure we are not needlessly updating/re-sending the session cookie.

[ClearlyClaire]

I don't think it's of any use, but it doesn't hurt either.