Patch for CVE-2012-5664

Options hashes should only be extracted if there are extra parameters.

Further reading:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5664

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM

We may also need to remove/replace `config/initializers/session_store.rb` and require users to generate their own secret.