Introduced the securityPolicy member of the Yesod typeclass, added tests...

..., and updated documentation and scaffolding
My concern with the current setup is that it implicitly *does* require the two changes to be done in lockstep. Changing `securityPolicy` will have no impact if you have a custom implementation of `makeSessionBackend`. So I'd rather address this directly with documentation, and have the two pieces of the puzzle explain clearly that it's recommend to make both the middleware *and* `makeSessionBackend` changes.