Make app mutation optional

As discussed in #59, a reference to the Koa app is currently accepted so the middleware initializer can modify it for performance reasons. This makes sense, but it sort of couples the middleware to the app, making it tricky to use with other middleware consumers such as [koa-router](https://www.npmjs.com/package/koa-router).

For example, if I want to use `koa-router` to define different behavior for different url paths-- some paths using sessions, others not. Even if I only attach the middleware for some paths, the `ctx.session` and `ctx.sessionOpts` getters will still exist on all context objects *all* paths, even though they shouldn't.

In fact, omitting the middleware doesn't even seem to remove much of the functionality at all. Without it, I could still get and commit session data from cookies as normal. Looking at the implementation, it seems like the middleware itself only really handles external storage initialization and the `autoCommit` option:

https://github.com/koajs/session/blob/10bb12246699101a0c87a2f3e2e09b1a79e10e33/index.js#L37-L50

I suppose the answer here is to just not access those properties where they're not supposed to exist, but it feels messy and likely to confuse other developers who might work on my code who aren't familiar with the internals of `koa-session`.

I'd like to use `koa-session` since it is clearly the most popular and well-maintained module in this space, but at the moment this is a huge blocker for me. I'd be willing to take the performance hit in order to avoid these problems, though I'm aware not everyone feels that way.

Would you guys be open to the possibility of making the `app` argument optional in the initializer, falling back to the slower way of doing things if it is not provided? I imagine it will be a decent amount of work to make this change, but I'm happy to do it if you'd be receptive to it.

If not I'll just save my time and use `koa-session2`. :\

Start with the linked index.js section at lines 37-50 and trace how the initializer uses the Koa app, external storage, and autoCommit. Define how initialization should behave without an app, including which context properties should exist, then verify the slower fallback and path-specific middleware behavior.

Written by the indexing model from the issue text.