Use session management on select routes

We don't need session management on many of the endpoints, some of which are frequently used. Support use of the session middleware selectively, so we avoid unnecessary database interaction.

/cc @hampelm