change the default `sessions` setting to be `false`

This means that no session cookie is used by default.  This is the
responsibility of the developer and should not be enabled without
them doing it.

This helps with security as no cookies are used without the developer
knowing about it.
Merge pull request #44 from redding/kr-sessionsoff

change the default `sessions` setting to be `false`