Fix session creation for every user

This fixes a wrong behavior in the strong protection. Now the
session protection is only tested if a session exists and
nothing is added to the session during the process.
Only one test is impacted and has been updated.

Fixes #179 and #156 
An empty session is not `None` but is `False`. This is what we assert here. The [SecureCookieSession](https://github.com/mitsuhiko/flask/blob/master/flask/sessions.py#L112) inherits [CallbackDict](https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/datastructures.py#L1899) which inherits a simple `dict` making this happen.
The test `test_session_protection_skip_when_off_and_anonymous` also use this behavior.