Rework sessions to make them more performant

We no longer automatically invoke Ring's wrap-session and store its data
in the servlet's associated HttpSession. Instead, we create a LazyMap
from the request and any session data from the HttpSession *unless* the
:session key is already present in the request, ostensibly because the
user prefers to use Ring's wrap-session.

We still take a slight perf hit checking the session data in the
response to know whether to invalidate the HttpSession (rather than just
let it expire).