fix(Session): Do not open sessions when using "open" authtype (refs #5209)

Frontend authenticators are not necessarily based on sessions. So, it's
not necessary to always open sessions. This commit disable creation of
sessions and emission of Set-Cookie headers when the frontend
authenticator has no getAuthSession() method (which means it does not
use sessions).