prevent crash when cookie doesn't contain "--"

This backports 881ce764f3fd70a20c5800892a132f1e6c8e7c50 so that rack
won't crash when there isn't a "--" in the rack_session cookie
Merge pull request #523 from bdimcheff/fix-missing-digest

prevent crash when cookie doesn't contain "--"