Don't raise on protect_from_csrf without sessions

Sessions can be implemented in a multitude of ways and not
all lead to the `sessions` option being set.
Merge pull request #1545 from skade/fix/issue1545

Roll-your-own session stores are broken