Port remaining cookie middleware changes from Katana.

The cookie middleware and security base package were ported to vNext before Katana v3 shipped. This PR ports the changes that happened since the original port.

Depends on https://github.com/aspnet/HttpAbstractions/pull/125
At least when using `DefaultHttpContext`. But given that we can replace the HTTP context by a custom one and that nothing in `HttpContext` ensures that `User` is never null, I'd personally keep this null check, just in case :smile: