upgrades hapi-auth-cookie and clears invalid cookies

I'm not really sure how to test this... @zeke - any ideas?