update send to 0.2.0
update cookie-signature to 1.0.3

Fix for timing attack
update merge-descriptors