Update db.py

It seems inappropriate to create a new session record just because one does not exist yet.

This means that is a developer calls request.session (just to read what is there, or if it is empty) that a new record will be written to the db.  It seems more appropriate to write to the db when something is actually modified.