Make sessions optional

I adjusted the commit message, so your pull request (travist/flatiron-passport#7) will be accepted.

> Make sessions optional
> - Introduce `option.session` so one can turn off sessions
> - If you have auth schemes which involve more than one handler, like an
>   OAuth token endpoint for example, you need to consider the callback of
>   flatiron and call it accordingly -- otherwise only the first handler
>   will get called.

;)