Add option to prevent generating new sessions

Motivation behind this change is to offer finer-grained control over when new sessions are being created. An example use case would be to have an entire site use the session middleware to access session data if a user has already logged in. Without this option the middleware will automatically generate a new session for each user, when a more economical approach would be to only create the session once the user has need for one (e.g. login).

This pull request would solve #451, #822, #695