Save session in memory instead of cookies by default for security?
Thank you for `koa` and `koa-session`, and I want to express some concerns.

By reading source code, I am not sure now that `koa-session`'s default behavior is safe enough. When init without an extranal store, the session will just [stored in the cookies](https://github.com/koajs/session/blob/master/lib/context.js#L113) with a [very simple base64 encoding](https://github.com/koajs/session/blob/master/lib/util.js#L16), which shared to brower.

It is easy to hack by decode cookies then modify the session. For example, if session storing `userId` (common practices
), hackers can easily impersonate other user to do some dangerous actions by reset `userId` in cookies.

Although `koa-session` with a special emphasis on cookie-based session implement in README, support more secure extranal store, its default behavior is not safe enough, especially for beginer. There are more and more people start to use `koa` and `koa-session`(see weekly downloads in npm), and I don't think it's a good idea to keep storing session in cookies.

Maybe storing session in memory by default is a good option for `koa-session`, just like [express-session](https://www.npmjs.com/package/express-session). It is more secure and easier to use. Of course, there are some new challenges: expire, memory overflow... But it is still an option worth considering.