Make session provider swappable and added postLogoutUrl

Hi guys, 

as previously discussed with you guys, I said our use case made client-sessions unusable as a session middleware since it stores the whole session in the cookie and it was dificult to have a workaround for that (keeping only the session id helps a lot). 

In this pull request, I made it possible to swap it to an existing one (like express-session) instead. If it's not provided, it falls back to client-sessions. In package.json, I added a reference to their repo at a specific commit which is the last one in their master (they didn't publish it to npm) which contain my fix (merged and approved by them) to make their lib compatible with express-session interface.

While I was there, I also added a postLogoutUrl in the case someone would want to be redirected to another page than `/` after logout (we wanted to be redirected to the login page in our case).

Hope it can be useful!