update guide to reflect default HMAC SHA1 in MessageVerifier used in SignedCookieStore [ci skip]