Delete cookie on session destruction

[iliakan]

Right now when the session is destroyed, the session cookie is made empty, not removed.

That's an incorrect behavior, the cookie should be deleted as well. For that, we need to set the expiration date to the past, not just an empty value.

[coveralls]

Coverage remained the same at 100.0% when pulling 00e9ec016518d8bb40d89cb0e07a1ff045acd19e on iliakan:patch-1 into 4ea5a63470b936642a18875997e1a627794d198d on koajs:master.

[dead-horse]

looks like browser will delete the cookie when received empty string as a cookie value ( works with chrome and safari)

[iliakan]

For me it affected autotests that failed when I switched from another session module.

[ejose19]

@dead-horse Any updates on when this fix will be merged?

[jmitchell38488]

@ejose19 @dead-horse I've created a pull request with code to expire the .sig and session cookies #180