Session lookups write to the backend on every request

[allen0099]

Problem

SessionManager.get_session() always ends with _save_session(): a JSON dump, a SHA-256 fingerprint and a SET, even when nothing but last_accessed changed. Nothing in the library reads last_accessed, and the TTL only changes on a sliding renewal. A request that also modifies the session pays two writes. The fingerprint is never read for session entries.

Proposal

Save in get_session() only when the session was renewed (optionally also when last_accessed is older than some granularity), and use a constant fingerprint for session entries. A keyword-only touch=True default could keep today's behaviour for direct callers.

Not breaking apart from last_accessed becoming coarser.