Secure sessions

Hi all,

I've written a first draft of an implementation of secure session cookies. It is Example 5 of [this repo](https://bitbucket.org/jocklawrie/skeleton-webapp.jl). It is intended as a starting point for developing a separate package (or piece of middleware in a larger package) that provides this functionality. Feel free to use/modify it as you please.

The security protocol is described in [docs/security_status.md](https://bitbucket.org/jocklawrie/skeleton-webapp.jl/src/5fd3263f52a95a6c7c33446c1f78124b4b512c58/docs/security_status.md?fileviewer=file-view-default).

At this stage the most important thing is to recognise that this implementation is based on my own not-so-thorough investigation, and I am not a security professional. Indeed the code hasn't been scrutinised by any security professionals, and therefore is **to be used at one's own risk**.

Rather than reject the example as insecure, I find it helpful to consider how long it would take a security professional to break the implementation (with a given hardware setup), and to gradually improve (increase) this time, i.e., harden the implementation.

With the current example I'm guessing it wouldn't take long, but it's a start. It's also the limit of my expertise. Suggestions for improving the security of the example and/or separating the code into its own package are most welcome. If you think a radical rethink is in order then I'm all ears.

Thoughts?