Needless session cookie set for anonymous users that breaks external caching (e.g. Varnish)

See https://wiki.fourkitchens.com/display/PF/Modules+that+break+caching,+and+how+to+fix+them

Problem

Adds an empty $_SESSION["CiviCRM"] to many types of pages, which creates a session cookie unnecessarily. Two hooks that this happens for are: hook_user() and hook_block().
Solution
In civicrm/drupal/civicrm.module:

Change the bottom of the civicrm_initialize() function to the following:
// fix needed for Pressflow lazy session initialization -
// if $_SESSION['CiviCRM'] is empty, unset it
if(empty($_SESSION['CiviCRM']))

{ unset($_SESSION['CiviCRM']); }

return true;
This will ensure that the CiviCRM session variable is only set as needed, and keep other pages cacheable by an external system.

As yet untested solution (from dlobo in #civicrm):
In civicrm/CRM/Core/Session.php:

Remove the $this->create(); line from the session's constructor function. Following patch is pasted from IRC and may need modification to apply. If so, please update this listing. Also, update if this works, so it can become the recommended solution.

svn diff CRM/Core/Session.php
Index: CRM/Core/Session.php
===================================================================
— CRM/Core/Session.php (revision 26441)
+++ CRM/Core/Session.php (working copy)
@@ -84,8 +84,6 @@
function __construct()
{
$this->_session =& $_SESSION;

• $this->create();
  }