fix(http): Allow setting your own cookie parser secret

By doing: `ss.session.options.secret = 'foo'`.