Prefer `cookies.signed` in Rails

`cookies` is fine for storing non-sensitive data, but using `cookies.signed`
makes sense as a default. Using `cookies.signed` means you don't need to worry
about whether data is sensitive.

Cookies, even signed ones, can be easily read by the end-user (see
http://www.andylindeman.com/2013/02/18/decoding-rails-session-cookies.html).
Using `cookies.signed` only prevents the end-user from *writing* them.