added documentation of sslOnlySessions and sslOnlyMiddleware, and fixed ...

...a type error in the example for makeSessionBackend customization
I think this breaks up the flow quite a bit, and also doesn't provide enough information. I'd rather put it in a NOTE: in a separate paragraph, and explain briefly that it's a MITM attack.