updates koa-session to 3.0.0, updates usage in session/auth exercises

A clean install of the deps for this project gives `koa-session` at 3.0.0, which features a breaking change: `app.use(session(app));` requires the `app` to be handed into the middleware.

This updates `koa-session` to the latest and updates the docs + implementation to reflect that change.