Don't create sessions if session protection is not enabled.

Prevents creation of cookies for sessions when there would effectively be no
useful information in the session otherwise. This is helpful for setups which
rely on no spurious cookies, like Varnish stacks.