Remove creation_time attribute from core Session class

The 'creation_time' attribute is unused and the semantics are not
defined.

Expiration time in the Session class is cookie expiration time,
which may or may not be the same as session expiration, since cookie
expiration is under the control of the user.

If creation_time were a required field that session factories were
mandated to create and preserve on session retrieval, then it could be
used to help establish an independent session duration limit, but this
is not currently the case.

If session duration limits are desired, it is probably better for
applications to develop their own logic using data stored within
the session.

Depending on the nature of the session backend, session factories
could independently track creation time for use in offline
session expiration and disk/memory recovery, but this does not
require an attribute within the core Session class.
Move session cookie management to SessionFactory

This commit moves cookie generation from Dancer::Core::Session
to Dancer::Core::Role::SessionFactory and moves universal
session cookie configuration parameters as well.

The rationale is that SessionFactories should manage implementation
details, such as knowing how cookies are set and retrieved, and should
have configuration that applies to all sessions (such as 'is_secure').

Dancer::Core::Session objects can then purely represent the specific
details of a *specific* session: the ID, the data, and the expiration.
cleanup Dancer::Core::Session

Groups attributes together, fixes documentation and removes trailing
spaces.
Fix documentation of SessionFactory

Changes POD headers to head2 for consistency.

Clarifies return values required by C<_sessions>.