Correct default value of ``cookie_httpOnly`` in docstring.

``cookie_httponly``'s default is True, but docstring had it as False.
Remove unnecessary signed_serialize parameter.

It was already accessible as an import.
Change asserts to use a different approach.

To assert that a header is one that sets a cookie as opposed to one that
deletes a cookie, we no longer assert the serialized session_id. This
means the tests would not break if `response.set_cookie()` makes any
changes to the serialized session_id before inserting it into the
cookie, as WebOb<=1.3 did by quoting certain characters.

The alternative approach chosen is to assert that 'Max-Age=0' is not in
the header string. A Set-Cookie header is either one to set cookie (in
which case 'Max-Age=0' would not be in the string), or one to delete
cookie (in which case 'Max-Age=0' would be in the string.)

It is a negative assertion, but all the alternatives would make the
tests too complicated and/or difficult to make sense of. This is the
least bad approach I can see for now.
Add tests for cookie-related factory parameters.
Rearrange ordering of cookie_ parameters.

Rearrange the ordering to be consistent with the factory's own
parameters and docstring, so that any missing parameters would be easier
to spot.
Fix bug where `cookie_path` parameter had no effect.

`cookie_path` parameter had no effect because it was not used by the
factory at all. We now set and delete cookie with its value as intended.
Fix bug with `cookie_domain`.

The factory was not making use of the `cookie_domain` value when setting
a header to delete cookie, meaning any cookie with a domain different
from the default would not have been deleted (as a cookie only gets
deleted if the path and domain match the ones used when the cookie was
set).