Apply IDataProtection to the session cookie value

[Tratcher]

The session cookie values are opaque GUIDs used to look up entries in the IDistributedCache. However, we don't have any verification saying we actually issued said cookie. Use IDataProtection to sign and validate the value. Otherwise ignore it and create a new session.

[Tratcher]

Also, if the cookie is marked as Secure (#106), bind it to the TLS token (https://github.com/aspnet/Security/issues/773, https://github.com/aspnet/IISIntegration/issues/31)

[Tratcher]

I've split the TLS binding work to a separate bug: #110