Only expect session on web request, and let the web session/authentication
managers provide them.

Access to cnx.data, which used to return session data, is deprecated: there is
no more access to session data from the repository side, and they should be
access from req.session.data from the web side.