adapt to cohttp 0.14.0 api
bump to 0.9.4
Use `Bytes` instead of `String` for future `safe-string` support

Can't activate safe_string yet until Lwt gets it