Lazy sessions

Implements the suggested solution for 'lazy sessions' from #155 so that requests that include a session ID in the cookie headers, but the route handlers never trigger session inflation, we "copy" (via a dummy session object) that to the response.

Also updated the `core.app.after_request` hook so that sessions are only flushed if the session object was instantiated. 

Resolves both #155 and #615.