Prevent ArgumentOutOfRangeException on empty cookie

An empty cookie would cause an ArgumentOutOfRangeException (edge case).

Stack trace:
```
System.ArgumentOutOfRangeException: startIndex cannot be larger than length of string. Parameter name: startIndex
at System.String.InternalSubStringWithChecks(Int32 startIndex, Int32 length, Boolean fAlwaysCopy)
at System.String.Substring(Int32 startIndex, Int32 length)
at System.String.Substring(Int32 startIndex)
at Nancy.Authentication.Forms.FormsAuthentication.DecryptAndValidateAuthenticationCookie(String cookieValue, FormsAuthenticationConfiguration configuration)
at Nancy.Authentication.Forms.FormsAuthentication.GetAuthenticatedUserFromCookie(NancyContext context, FormsAuthenticationConfiguration configuration)
at Nancy.Authentication.Forms.FormsAuthentication.<>c__DisplayClass7.<GetLoadAuthenticationHook>b__6(NancyContext context)
at Nancy.BeforePipeline.<>c__DisplayClass4.<Wrap>b__3(NancyContext ctx, CancellationToken ct)
```

The issue wasn't caused by Nancy, but this happened to a colleague, where all her cookies were empty for some reason (external ones as well).

Would you like a test for this as well?