Only set cookies in the response if the session data has changed

[jtgeibel]

This will help resolve an issue observed in production crates.io. My proposal is to change session() to return a shared reference, and add a session_mut() providing mutable access. Calling session_mut() will set a a possibly_modified: bool flag. If no call to session_mut() has been made, then the session has not been modified and it is not necessary to add the Set-Cookie header to the response.