Managing cookies in custom exception route is possible.

Related issue: #11679

Change default middleware stack order, move ShowExceptions middleware
under Cookies and Flash middleware, so that cookies and flash are
manageable in custom exception route.

This is extracted from @yonbergman 's old commit.

I'm not sure this is a good change, but it is a real problem. What do you guys think?