Fix clear_cookie and session_config

Change session_config api to get a
badmatch if the key is supposed to be
in the config, and return a default value
only when explicitly specified.

We found these inconsistencies while running the
dialyzer and changed to avoid returning `undefined`
given that the session_config value could be any term.