Use the non deprecated version of source
prevent crash when cookie doesn't contain "--"

This backports 881ce764f3fd70a20c5800892a132f1e6c8e7c50 so that rack
won't crash when there isn't a "--" in the rack_session cookie

Fixes #523