Fix issue with attempting to write to a nil session store

It is possible and valid to have no session store configured (e.g. when using warden from a purely API-accessed app). SessionSerializer throws an exception if a rack session does not exist due to trying to access it. This changes the session to be injected to SessionSerializer and defaults it to a hash if no session exists (basically a NullSession). Fixes https://github.com/plataformatec/devise/issues/2065