fix: token and cookie session id miss match.

[youngsofun]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

related feature not in use yet, so the pr is safe.
find something need improvement when working with the clients.

1. session token use the session id generated when processing cookie and stored in context
2. small refactor of request login and refresh

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is 

[youngsofun]

cc @sundy-li ready to review