Improve default cookie params and allow overriding them in config

This PR does three things:
1) It strips {http_only, false} or {secure, false} options from CookieOpts before calling cowboy_req:set_resp_cookie (those seem like reasonable options to set, but Cowboy barfs on them)
2) It sets the default cookie opts to [{http_only, true}, {secure, false}, {path, <<"/">>}] for HTTP requests or [{http_only, true}, {secure, true}, {path, <<"/">>}] for HTTPS requests (I think this is what most users would expect/want)
3) It allows the default cookie opts to be overridden in the app configuration (in addition to allowing them to be overridden via a call to giallo_session:new/2)

Thanks!