Default cookie name doesn't satisfy RFC6265
The default cookie name [`koa:sess`](https://github.com/koajs/session/blob/master/index.js#L21) contains `:`, which is not a valid token character in accordance with [RFC6265](https://tools.ietf.org/html/rfc6265#section-4.1.1) and [RFC2616](https://tools.ietf.org/html/rfc2616#section-2.2). Although most web browsers and servers allow this, it causes problems in some more strict environment such as [spray](http://spray.io).

Would you consider remaining it? If so, should we take backward compatibility into account?
