fix: parse JSON cookies with falsy values

[spokodev]

JSONCookies() only writes the parsed value back when it is truthy (if (val)), so a cookie whose JSON payload is false, 0, null or "" is left as the raw j:-prefixed string instead of being inflated. The README states such values "will be exposed as the result of JSON.parse".

JSONCookie() already returns undefined only on parse failure, so guarding on val !== undefined preserves the "keep the original value on invalid JSON" behaviour while correctly parsing falsy values.

Refs #168.

[kilisamemarisaaa]

[P1] Preserve the invalid-signature sentinel for signed JSON false. The middleware runs JSONCookies() over req.signedCookies after verification (lines 64–65), while signedCookie() and the README use boolean false to signal a failed signature. With this condition, a correctly signed j:false payload is also converted to boolean false. I reproduced both a valid cookie created with cookie-signature.sign('j:false', secret) and the same cookie with a corrupted signature; req.signedCookies.flag is false in both cases, so callers can no longer distinguish authentic data from signature failure—the exact ambiguity raised in issue #168. Please resolve that representation/API conflict before parsing false here, and add a middleware-level test covering valid j:false versus a tampered signed cookie.