Enable Samesite cookie on API server

[MrOrz]

This PR fixes #186 via:

• Upgrades koa and koa-session2 for SameSite support
• Turn on samesite and secure for session cookies
  • If secure is not set, session cookies (koa:sess and koa:sess.sig) won't have Secure flag, and the browser does not apply SameSite=None
  • Adds env var COOKIE_SAMESITE_NONE to toggle it. In some case samesite may be not required.
• Trust proxy headers
  • This allows Koa to recognize x-forwarded-proto and send secure: true when calling new Cookies().
    • Related code analysis: https://github.com/koajs/koa/issues/974#issuecomment-307232498
  • If secure: true is not set on new Cookies(), cookie middleware will throw exception saying that secure flag is only available under secure connections when we try to set a secure cookie.
  • Add env var TRUST_PROXY_HEADERS to toggle it. This is because in some configuration there may be no proxies in front of koa. In that scenario we had better not trust proxy headers.
• Env variables & x-forwarded-proto setup: see cofacts/rumors-deploy#13

[coveralls]

Coverage remained the same at 88.158% when pulling 49d34e8e6c0d55ac9fe664c23fcc8c6187cc7d0b on samesite into 60d671509d2fa70e0a2bd733742818c34ba2dc44 on master.