Defer storing the session until it has a value set

Fixes #576 and #323.

The reason for checking `sessionWasEmpty` is to handle the case where the session previously had something in it, and this particular request emptied it.