Only /_session request send the authSession. fixed #223

* no auth requests url dont send the authSession
* baseauth dont create session cookie too
Merge pull request #277 from cnpm/only-authsession-send-cookie

Only /_session request send the authSession. fixed #223