Static and session security fixes for Plug

[yurko]

@hubertlepicki

Rails had a similar issue back in a day where it would de-serialize stuff from params/cookie (don’t remember exactly) into classes. Combine that with ability to re-define classes at run time and you have remote code execution at it’s finest.

so did PHP PHP Object Injection | OWASP Foundation