FIX: default_reaction was not working

I noticed that aliased default_reaction was not working, it was always reporting :drop_session (this should
be the last one used by SessionHijacking).

It is now possibile to define a specific default_action for each of the different attacks. Base#default_reaction
is used to fire the needed reaction, it gives precedence to the reaction defined in the options Hash.