Don't modify the Flask session unless there's a reason to 

This enables authenticated Flask handlers to *not* return 'set-cookie' headers, thus enabling caching headers on authenticated requests. Otherwise, set-cookie (for the session) on the response causes my server environment (App Engine) to throw away the cache-control header. To clear the session in Flask I'm doing this mid-request:

```flask._request_ctx_stack.top.session = app.make_null_session()```

The current flask_login code is calling pop() on the null session, which explodes. But __contains__ is totally fine.

The reason I want to do this is so I can return a reasonable unguessable URL to the user and have that cached. Generating the URL requires auth (and flask_login), but from that point on the URL should be cached.