Port remaining cookie middleware changes from Katana.

The cookie middleware and security base package were ported to vNext before Katana v3 shipped. This PR ports the changes that happened since the original port.

Depends on https://github.com/aspnet/HttpAbstractions/pull/125
Now that you mention it, context.User is guaranteed not to return null, so I can remove that first check.