override setup_session method to support custom session management

I always use Rack::Session::MongoSession in Padrino:
```ruby
class App < Padrino::Application
  use Rack::Session::MongoSession, {
    :host => "localhost",
    :db_name => 'mongo_sessions',
    :marshal_data => true
  }
end
```
But if enabe csrf protection:
```ruby
 enable :protect_from_csrf
```
Because Rack::Protection::AuthenticityToken is used before Rack::Session::MongoSession, 
Padrino will warn "`protect_from_csrf` is activated, but `sessions` seem to be off. " 
I could cancel warn through Padrino::IGNORE_CSRF_SETUP_WARNING.
But, Rack::Protection::AuthenticityToken would use session to store csrf token.

So, I think Padrino should allow custome session in application setup.