Allow on-demand sessions

**Is your feature request related to a problem? Please describe.**
The developed server application may want to offer a session ID cookie only when the user is logged in, that way the server is not wasting its resources on a malicious client repeatedly clearing their cookies and refreshing the page.

**Describe the solution you'd like**
Have a public function that does the actual session generation, and have it get called where it is currently getting generated.
Then have a config option `"session_auto_generate": true`, which does what it does currently, and if it is set to false, then the generator function will not get called automatically, it is up to the programmer to call that function, say in a `/login` endpoint when correct credentials are passed in.

**Describe alternatives you've considered**
Custom rewritten logic of sessions, but it introduces redundancies.