Test that static content does not cause session retrieval.
Lazy session handling in after_request hook.

Ensure that if no session object was instantiated, that we do not try
and flush it.

However, in the case that a session ID exists in the request headers,
we need to "copy" that to the response; or more precisely, create a
dummy Session object with the same ID and use that to create the cookie
header in the response.

Closes #155 and #615.
reflect change
Merge branch 'bugfix/lazy_sessions'