Static and session security fixes for Plug

[mariusbutuc]

Is there some sort of pipe that we can subscribe to for all sorts of Elixir security releases?