Change the strategy for obtaining session cookies

In the previous implementation when the provider was asked for a session
cookie and finds out that the one it knows is no longer valid, makes a request
to the real system to obtain a new one.

If during the time that request is being made, is asked for another session
cookie, will fire another request, and so, and so...

The new implementation assumes there always will be a valid session cookie in
the database, which can be guaranteed by calling SessionCookie.refresh
periodically.

This is clearly a disadvantage with respect to the old implementation, because
calling Provider#provide allways returned a valid session cookie. Well, I'm
not exactly sure about that, and that is the reason of this change (and that I
didn't want to introduce any locks).

Issue #11.
Configure puma web server

Issue #12.