Disable saving IP / browser

[WhyNotHugo]

The current behaviour of saving the IP and browser of each session is a privacy (and legal) nightmare.

We're sorely missing an option to disable this behaviour. For my intended use case of this feature, I needed only a session which can be used as a ForeignKey, but not storing IP and browser (these would require user consent, reviewing privacy policy, etc, and they're information that I don't need).

A setting to toggle this (e.g.: SESSION_TRACK_IP and SESSION_TRACK_BROWSER) might be a good-enough approach.