Fix bad example for setting session cookie config via web.xml

Missing a nested <cookie-config> tag, which wasted a bunch of my time!
Making sure it wastes no one else's time...