change the default `sessions` setting to be `false`

This means that no session cookie is used by default.  This is the
responsibility of the developer and should not be enabled without
them doing it.

This helps with security as no cookies are used without the developer
knowing about it.

Closes #43.

@jcredding the diff on the system tests is ugly b/c I moved everything under the `Deas` module and renamed the contexts.  The gist is at the bottom of the diff (the added context).  The only reason I had to change it at all is b/c the session test assumed sessions were on.