Improve cookie based session backend docs.

Note the don't require sessions to be in installed apps.
Fix a typo in a comment.