Security: Session cookie defaults to secure=false and no sameSite attribute

## Summary

express-session defaults cookie.secure to undefined (falsy) and does not set sameSite, meaning session cookies are sent over plaintext HTTP and are vulnerable to CSRF in older browsers.

## Affected Code

session/cookie.js:25-44:

var Cookie = module.exports = function Cookie(options) {
this.path = '/';
this.maxAge = null;
this.httpOnly = true;
// NOTE: no this.secure = true; no this.sameSite = 'lax';
};

Default cookie attributes:
- httpOnly: true ✅
- secure: undefined (falsy) ❌ — cookie sent over HTTP
- sameSite: undefined (not set) ❌ — browser defaults vary

## Impact

1. Session cookies transmitted over plaintext HTTP enable network sniffing (WiFi, MITM proxies)
2. Missing sameSite leaves CSRF protection to browser defaults — older browsers default to SameSite=None
3. Every deployment that does not explicitly set these options is affected

## Additional Issue: MemoryStore unbounded DoS

MemoryStore (session/memory.js:40-43) has no session count limit, no max-size check, no eviction policy. With saveUninitialized default behavior, an attacker sending cookieless requests creates unlimited sessions until OOM.

I understand the README warns MemoryStore is for development only, but the cookie security defaults affect ALL store backends including production Redis/Mongo stores.

## Suggested Fix

Default to secure cookie settings when possible:

this.sameSite = 'lax';
// And warn when secure is not explicitly set in production