SessionToken validation through cookie

Hi Dominick,

Many thanks for the great library. I had a specific requirement to collect session tokens from a cookie, see:
http://stackoverflow.com/questions/17616979/thinktecture-identitymodel-authenticationconfiguration-mapping-for-cookie-how

Though after I've looked into the source code, it seems the session tokens are only picked up from a specific HTTP header (e.g. Authorization).

Also from the looks of it, even though Cookie mapping has been provided for, you don't actually use it at the authorisation stage? I'm guessing there should be an * if (Configuration.HasCookieMapping) * check in HttpAuthentication.Authenticate ?

You can include this pull request if you see fit.

Ibraheem