Only send a session cookie when it's actually needed

I was going through https://github.com/gittip/www.gittip.com/branches yesterday and noticed an old `issue-1499` branch, so I dusted it off and completed it.

This PR fixes #1499. It also resuscitates a change that was in #2041 but wasn't kept in #2332.

Please review, but don't merge yet, we need to land #2384 first.