Make sessions optional

- Introduce `option.session` so one can turn off sessions
- If you have auth schemes which involve more than one handler, like an
  OAuth token endpoint for example, you need to consider the callback of
  flatiron and call it accordingly -- otherwise only the first handler
  will get called.
Merge pull request #1 from pvorb/patch-1

Make sessions optional