Prevent creating a new session until necessary - #2685

Make $session in Auth\Simple nullable, and add getSession() function
that will load the session if it was not set.  Informative actions
such as checking if the user is logged in will null check the session,
and not call the function, to avoid starting a session.  Actions that
have side effects, such as redirecting to login, will use the function
and thus start a session.

Add $canCreate argument to Session::getSessionFromRequest, to allow
retrieving a session only if it already exists, but avoid creating one
if one doesn't exist already.

Split getSessionFromRequest into two functions, one that will create
a new session if one does not exist, and one that will return null if
a session does not exist.

This allows different functions to have separate `@return` signatures.