fix(Session): Do not open sessions when using "open" authtype (refs #5209)

Frontend authenticators are not necessarily based on sessions. So, it's
not necessary to always open sessions. This commit disable creation of
sessions and emission of Set-Cookie headers when the frontend
authenticator has no getAuthSession() method (which means it does not
use sessions).
Merge pull request #1367 from eguaj/3.2-A5209

fix(Session): Do not open sessions when using "open" authtype (closes #5209)