signedCookie is unlikely to be used correctly

cookie-parser's signedCookie function has the following behavior when it encounters an unsigned value:

"If the value was not signed, the original value is returned."

This is subtle behavior, and it seems unlikely that a caller would actually know to check that the return value was different from what was passed in. If the caller depends on the signature mechanism to prevent tampering this could be a serious problem.

A cursory check shows all 3 callers on github are not checking the return value:

https://github.com/search?q=%22cookieparser.signedCookie%22+-path%3AcookieParser&type=Code&ref=advsearch&l=&l=

I'd suggest changing the API to return false if passed a non-signature cookie value, similar to failing the signature check.