padrino/padrino-framework — pull request #1663 by cookiebody (2014-04-24 04:35:41+00:00)
Title: override setup_session method to support custome session management

I always use Rack::Session::MongoSession in Padrino:
```ruby
class App < Padrino::Application
use Rack::Session::MongoSession, {
:host => "localhost",
:db_name => 'mongo_sessions',
:marshal_data => true
}
end
```
But if enabe csrf protection:
```ruby
enable :protect_from_csrf
```
Because Rack::Protection::AuthenticityToken is used before Rack::Session::MongoSession,
Padrino will warn "`protect_from_csrf` is activated, but `sessions` seem to be off. "
I could cancel warn through Padrino::IGNORE_CSRF_SETUP_WARNING.
But, Rack::Protection::AuthenticityToken would use session to store csrf token.

So, I think Padrino should allow custome session in application setup.