Allow session configuation

* add #sessions Lotus::Configuration, used to enable and configure sessions
* add Lotus::Config::Sessions responsible for sessions configuration and
  sessions middleware construction
* move assets middleware construction to Lotus::Config::Assets to be
  consistient with sessions
* include Lotus::Action::Session to controllers if sessions are enabled
* defer loading default middleware stack (assets and sessions) to load time,
  and not middleware stack initialization.
* change Lotus::Config::Middleware tests to account for the
  configuration loading that happens at application initialization, test
  for disabled assets was false positive in previous setup

Closes #2
I think this knowledge should be managed by `Config::Sessions` initialization process, and not being leaked in this context.