Changes cookie serializer to :hybrid

Serialising sessions using `Marshal` leaves Rails applications open to remote code execution should the `secret_key_base` be divulged. This change limits the damage to being able to read/write session data only.

The `:hybrid` option will transparently convert sessions from `Marshal` to `JSON` formats, so existing sessions will still be accepted.