Make sessions optional

- Introduce `option.session` so one can turn off sessions
- If you have auth schemes which involve more than one handler, like an
  OAuth token endpoint for example, you need to consider the callback of
  flatiron and call it accordingly -- otherwise only the first handler
  will get called.