Destroy sessions in the cookie not just memory
Refactor cookie writing

flush and destroy now use write_session_id to update the cookie.

Unfortunately, that required copying that function from
Dancer::Session::Abstract and modifying it to support 'session_cookie_path'.

The upside is that Dancer::Session::Cookie now supports the
'session_domain' parameter.
Delay writing cookie or flushing to after hook

Standard Dancer session behavior forces a flush on every write.  For
cookie-based sessions, that's a problem because we're encrypting and
setting a cookie each time.  While Dancer only tracks the *last* cookie,
the response headers accumulate each cookie flush.

This commit makes write_session_id and flush into no-ops.  Instead,
it turns the Dancer::Session::Cookie into a singleton.  This is
no different than using the Dancer::Cookies entry for the session name
as a singleton, except we don't have to decrypt/encrypt on every
access.

The commit also modernizes some other code as part of general
refactoring necessary to make the changes possible to test.

The most important test -- the actual server test -- continues
to pass without modification.
Convert to use Session::Storage::Secure

Preserves old decryption routine to decode old cookies, which S::S::S
will reject.
convert distribution to @DAGOLDEN style dzil
remove release tests from t
add stopwords
Changes
bump Changes