Fix anonymous visitors getting a session cookie on first visit (#24584)

app/controllers/api/base_controller.rb

app/controllers/application_controller.rb

app/controllers/concerns/web_app_controller_concern.rb

app/controllers/media_controller.rb

app/controllers/media_proxy_controller.rb

app/views/layouts/application.html.haml

spec/controllers/application_controller_spec.rb

spec/requests/anonymous_cookies_spec.rb