Reproducing keygrip verification
## Summary

I hope to reproduce cookie keygrip verification for my websocket server and failed. I wonder where I can find exactly how koa-session verifies the cookie so that I can reproduce it correctly. Alternative methods to get `koa-session` working with `WebSocket` are also welcome.

## Background

My app has two interfaces: a HTTP interface, which runs on Koa with koa-session, with signature; and a WebSocket interface, which runs on `ws`.

I hope the `ws` server would verify cookie signature the same way koa-session does.

The existing solution at https://github.com/koajs/session/issues/53#issuecomment-311601304 doesn't work for me.

## Attempted solution

I tried to write a function to parse cookie and verify signature the same way koa-session did. The parsing works but verification fails.

Perhaps I got Keygrip parameters wrong. I try searching the source code in koa-session but couldn't find Keygrip reference, or anything looking relevant.

The parsing function (in TypeScript) is as follows. It successfully parsed the cookie string but failed to verify it. If I disable signature verification, it works as expected otherwise.

```typescript
import * as cookie from 'cookie'
import * as Keygrip from 'keygrip'
import { SESSION_KEY, SESSION_KEYGRIP_KEYS, SESSION_SIGNATURE_KEY } from 'settings'

const keys = new Keygrip(SESSION_KEYGRIP_KEYS)

export function parseCookie(cookieIncoming: string | string[] | undefined): {[key in string]?: string} {
    if (!cookieIncoming) {
        return {}
    }
    const cookieString: string = typeof cookieIncoming === 'string' ? cookieIncoming : cookieIncoming.join('')
    const cookieObj = cookie.parse(cookieString)
    const mainCookie: string = cookieObj[SESSION_KEY] || ''
    const cookieSignature: string = cookieObj[SESSION_SIGNATURE_KEY] || ''
    console.info('cookie', mainCookie)
    console.info('signature', cookieSignature)
    if (!keys.verify(mainCookie, cookieSignature)) {
        console.info('bad signature')
        return {}
    }
    else {
        const session: string = Buffer.from(mainCookie, 'base64').toString('ascii')
        try {
            return JSON.parse(session)
        }
        catch {
            return {}
        }
    }
}
```

Output:
```
17:48:01 0|actionAp | cookie eyJhdXRoVG9rZW5JZCI6IjI4YmZmNWExLTFkMzUtNDk0Yi1hZGNjLTFhOWM3NmI0NTg0OSIsInRva2VuU2VjcmV0IjoiOGZlMGFkZDVmNWI0 // Truncated for security reasons
17:48:01 0|actionAp | signature l0i1WS8fV9JkZwQWCWCt0HEPyWM
17:48:01 0|actionAp | bad signature
```