lazzy sessions feature

By passing an `emptyFn` option to `connect.session()`, which should return `true` if the session is considered empty, here's a way to avoid maintaining empty sessions and the corresponding `set-cookie` in responses.

This is needed for reverse-proxy caching where a `set-cookie` in a response defeats cache-ability. Also nice for performance reasons, i.e. a lightweight JSON endpoint that shouldn't be creating a session every time it's hit.