Make sessions optional

  - Introduce `option.session` so one can turn off sessions
  - If you have auth schemes which involve more than on handler like an OAuth
    token endpoint for example, you need to consider the callback of flatiron
    and call it accordingly; otherwise only the first handler will get called.