Remove suggestion that Procs can be used as session secrets.

The docs suggest you can use a `Proc` as a session-signing key, and does not seem to be true from spelunking the code and setting up a minimal app using just the `Cookie` middlewares.

It also promotes a dangerous practise: using the current user to pick a signing token means you need to unmarshal the session and send part of it to the database, *before* you've verified the session cookie's authenticity.