Various fixes

Coalesce null token to byte[0]
Allow encoding and decoding of unsigned cookie
Differentiate between decoding a malformed vs unsigned cookie
Currently error on decoding unsigned cookie
Verify checks the cookie is active

Verify checks that the cookie is signed and also active.

A cookie with a negative expiry time is always considered
active.