Session cookie survives (maxAge + zero value bug)

I'm using `koa-session` with params:
```
{
key: 'sid',
prefix: 'sess:',
httpOnly: true,
path: '/',
overwrite: true,
signed: false,
maxAge: 3600 * 4 * 1e3,
rolling: true
}
```

Session removal does this: `ctx.cookies.set(key, '', opts)`.

Unfortunately, in "cookies" module, `toHeader` has this:

```
if (this.maxAge) this.expires = new Date(Date.now() + this.maxAge);
```

So no value (cookie deletion) actually leads to empty cookie with future expiration.

Start by tracing session removal to the cookies module's toHeader logic shown in the issue, then reproduce deletion with a configured maxAge and an empty value. Confirm whether the fix belongs in this middleware or the cookies dependency; done means removing a session produces a cookie with an expiration that prevents it from surviving.

Written by the indexing model from the issue text.