Explicitly avoid starting a session for / route

This fix ended up being much simpler that I had thought. I started by explicitly adding sessions to all routes which needed them, but it didn't work well. We can modify this code in the future to blacklist other routes if needed.

The server was generating a session for every load balancer request and putting unnecessary strain on Redis. This blacklists the / route from generating a session, which is what the load balancer should hit.

I tried to write a test for this but failed because I realized the cookies are HTTPOnly. I ran some tests through a reverse proxy, and the change causes the desired behavior.

Closes #275