Reduce unnecessary access/modifications to the Session object

This pull request helps to reduce unnecessary access and modifications to the session object.  This can be issue if the developer wishes to use Vary:Cookie headers that are only applied when the session is actually accessed.  For example, public pages that are not specific to a user do not always need a Vary:Cookie header, and as long as the request can be satisfied without accessing the user object, then adding a Vary:Cookie header may be unnecessary.

Currently the session is read and the user is loaded on all requests.  

##### Modify how the user is loaded so that reads to the session only occur when the user is actually needed. This change modifies the loading functionality so that the user is not loaded until ```current_user``` is accessed.

This is achieved by delaying calls to ```login_manager._load_user``` until the ```current_user``` is requested.  The loaded user is then stored on ```_request_ctx.top.user```

###### Side effects
* ```_request_ctx.top.user``` is not available until *after* ```current_user``` is accessed at least once.  I don't know if this is a problem because I am not aware of how many people use current_user exclusively or attempt to read the user directly from the request context.
* This removes the order dependency of applying the login manager first and other dependent extensions (e.g. Flask-Principle second) to the Flask Application (example: https://github.com/mattupstate/flask-principal/issues/22) 

##### Reduce Unnecessary session accesses and modifications for Anonymous users.
* Currently each User Access processes the session data through _session_protection.  In the case where the user is anonymous and ```SESSION_PROTECTION``` is not used, the _session_protection functionality was accessing and modifying the session unnecessarily.  This is avoided by not setting a new ```sess['_id']``` value when there is none.  Since a missing ```session['_id']``` is the same as a mis-matched ```sess['_id']```, these should be effectively equivalent.
* Should fix https://github.com/maxcountryman/flask-login/issues/120 in most cases.