[FIX] web: avoid marking session as modified every time

The `rotate` flag introduced by 31d817e8
was initialized at the very end of the session init, after
the reset of the `modified` flag.
This had the side-effect of marking the session as modified
for every request, saving the session to disk every time
even without any change.

Closes #6795