Cookie being set on uninitialized session when `saveUninitialized` option is disabled but `rolling` option is enabled

[JamesMGreene]

Currently, the session cookie is being set for uninitialized sessions even when saveUninitialized option is disabled if the rolling option is enabled. This doesn't make any sense to me.

I do expect the rolling option to continually extend the expiration date with each new request, which is it's intended purpose. However, I do NOT expect that option to override the saveUnitialized option.

Use Case

• I only want to maintain sessions for authenticated users, thus I set saveUnitialized to false.
• I want to continually extend the expiration date of these authenticated user sessions upon receiving a new request [before the session naturally expires], thus I set rolling to true.
• I am using a Session Store implementation that supports touch, thus I set resave to false.

[gabeio]

I agree the rolling should not override saveUninitialized. Rolling should only be extending an expiration date only if the cookie already exists especially with saveUninitialized.

[JamesMGreene]

@gabeio: Thanks for confirming. My PR #240 to test and fix this is linked. 👍