Use exclusively Blake2s as a MAC and ChaCha20 as a stream cipher.
Blake2s is always faster than SHA2 and could be safely used as a MAC
without HMAC construction (therefore, it is much faster than HMAC-SHA256).
ChaCha20 is a bit slower than AES-CTR, but its usage causes less
allocations. And it is faster without AES hardware optimization
(appengine for example).

BenchmarkLegacyEncode-8     239144   4504 ns/op  3445 B/op   21 allocs/op
BenchmarkLegacyEncode-8     261038   4499 ns/op  3442 B/op   21 allocs/op
BenchmarkCompactEncode-8    933446   1304 ns/op   721 B/op    4 allocs/op
BenchmarkCompactEncode-8    927328   1331 ns/op   721 B/op    4 allocs/op
BenchmarkLegacyDecode-8     298273   3923 ns/op  2312 B/op   17 allocs/op
BenchmarkLegacyDecode-8     298401   3944 ns/op  2367 B/op   17 allocs/op
BenchmarkCompactDecode-8    806112   1359 ns/op   465 B/op    3 allocs/op
BenchmarkCompactDecode-8    905617   1348 ns/op   471 B/op    3 allocs/op

simplify use of Blake2s and ChaCha:
- use keyed Blake2s instance
- use 192bit nonce with XChaCha20 (add 8 byte 'version+timestamp' header to mac)
- get rid of cookie name length restriction (yes, allocate []byte(name))