Fallback to a hash-backed session store to ease testing (TORQUE-1016)

Instead of adding this to torquebox-no-op, it felt cleaner to just
have our session store implementation detect if TorqueBox is
available. If not, the session gets backed by a regular hash.