Add cookie encryption salt to session

[conectado]

Closes firezone/product#365

[jamilbk]

Lgtm

[jamilbk]

@conectado Just double-checking -- did you happen to test local sessions still work fine after enabling this setting? I.e. sign in / sign out. I imagine a user would need to clear cookies once this is rolled out?

[conectado]

@conectado Just double-checking -- did you happen to test local sessions still work fine after enabling this setting? I.e. sign in / sign out. I imagine a user would need to clear cookies once this is rolled out?

I have tested logging in and out and that session is working. But haven't tested what happens after to a pre-existing session when the setting gets enabled. I'll do that now.

[conectado]

@jamilbk seems like after enabling the setting, the old unencrypted cookie gets invalidated and the user is prompted to login again. I think this is the desired behavior. And just in case I tested the other way around, disabling the feature, and it works the same way.

[jamilbk]

Awesome, thanks!