Support keys that start with `_`

This lets cookie-session support keys that start with `_` which brings it more in line with other session providers.

[closes #17]