Update tough-cookie version due to security vulnerability

[sophieklm]

There has been a new release of tough-cookie to fix the following:

The tough-cookie module is vulnerable to regular expression denial of service. Input of around 50k characters is required for a slow down of around 2 seconds.

Unless node was compiled using the -DHTTP_MAX_HEADER_SIZE= option the default header max length is 80kb so the impact of the ReDoS is limited to around 7.3 seconds of blocking.

At the time of writing all version <=2.3.2 are vulnerable

See: https://nodesecurity.io/advisories/525

[coveralls]

Coverage remained the same at 100.0% when pulling 7f2bff2 on sophieklm:tough-cookie-update into 7239e1e on request:master.

[analog-nico]

Thanks a lot @sophieklm ! I just published [email protected] which includes the fix.