cookie-store: move validation of cookie secret options to sessions package

[shrayolacrayon]

What

Since all of the cookie sessions logic lives in the sessions package, it makes sense to do all validation there as well rather than having that duplicate logic in auth and proxy.