Use SHA1 to create filestores

[karthik-rangarajan]

In line 92,

var fileName = this.prefix + crypto.createHash('md5').update(sid).digest('hex');

md5 is used to create a hash that can be appended to the file store. However, md5 has been proved to be broken, and it is entirely possible that multiple keys existed that would result in the same md5 hash. For applications that are using unsigned cookies, this could potentially be a problem. The simplest solution is to replace the md5 with sha1.

[gabegorelick]

+1 Although in practice, the vast majority of cookies will be signed. E.g express-session and its predecessor connect-session really force you to set a secret to use for signing.