Merge pull request #11677 from jaggederest/master

update guide to reflect default HMAC SHA1 in MessageVerifier used in SignedCookieStore

[ci skip]