FIX: default_reaction was not working

I noticed that aliased default_reaction was not working, it was always reporting :drop_session (maybe because this is the last one used by SessionHijacking).

It is now possibile to define a specific default_action for each of the different attacks. Base#default_reaction is used to fire the needed reaction, it gives precedence to the reaction defined in the options Hash.

This should be related to issue #50 since I was experiencing the exactly same problem.