only set sessions if not empty
> This module provides "guest" sessions, meaning any visitor will have a session, authenticated or not. If a session is new a Set-Cookie will be produced regardless of populating the session.

and by not empty i mean there's more attributes than just `.sid`. you don't want your static middleware concurrently creating a bunch of cookies.
