[web session] fix session handling so we get a chance to have for instance the 'forgotpwd' feature working on a site where anonymous are not allowed fix several pbs: * we need a session id and a session cookie anyway, else subsequent http queries are unrelated * this imply some changes in the session attribution workflow for session without a cnx * some views/selectors must be fixed for cases where session has no cnx On the way, avoid unnecessary Redirect on successful login. closes #750543

# type attribute might already be there if migrating from
# version < 3.5 to version >= 3.5.3, BaseTransition being added
# in bootstrap_migration
if versions_map['cubicweb'][0] >= (3, 5, 0):
    add_attribute('BaseTransition', 'type')
    sync_schema_props_perms('state_of')
    sync_schema_props_perms('transition_of')