Reading session/cookies from WSGI
It's created by the session middle ware. There are no such thing as sessions in http itself. It's usually done by setting a cookie, but can be done in other ways too. 
So to answer the question of "when" it is created this is typically done by the session middleware, when it gets a request that does not already have a session cookie in it.
Is there any way to retrieve sessions right from the WSGI (using a middleware)?
I know that it depends on your SessionMiddleware but I wonder if there are hints to figure out when a session is created.