autoconfig makes django.contrib.auth incorrectly depend on django.contrib.sessions

[SpoonMeiser]

The django.contrib.sessions app is only required if the database is to be used as the session backend. To enable sessions, only the middleware is required.

Also, I'm not sure that sessions are technically required for authentication to work, although it wouldn't be useful in most situations.

django.contrib.messages also incorrectly adds django.contrib.sessions to INSTALLED_APPS