Remove insane copypasta from CookieStore, refactor.

I originally based the code on the gorilla implementations of
CookieStore and FilesystemStore. I went along with the cookiestore
case where they save sess.Values in the cookie itself. Now I think
it's doing the right thing and saving values to C* with gob and only
passing the session ID (a guid) in the cookie.
Another TODO.