Session data is always created, even when nothing is written

The basic API is, ask for ISession, get a dict into which you can put stuff. This is however implemented in a manner that *always* creates a new entry (see zope.session.session.Session.__getitem__), which is bad, since one should not perform write operations in an otherwise read-only request, and can also lead to a denial-of-service vulnerability, when session data is stored in the ZODB.