Allow the ability to pass session:false when creating a new strategy

This way, you don't need to continually pass this parameter in every single route when authenticating.

For example:

``` javascript
passport.use(new BearerStrategy(
{session: false},
function(token, done) {
User.findOne({api_key: token}, function(err, user) {
if (err) { return done(err); }
if (!user) { return done(null, false, {message: "Token is not valid"}); }
return done(null, user);
});
}
));
```

The issue names BearerStrategy configuration and route authentication but no files or tests. Start by tracing how strategy options and the session setting are handled, then inspect existing authentication tests. Done means session:false configured when creating a strategy is honored without repeating it on every route.

Written by the indexing model from the issue text.