Refactor whiplash

Submitted for your consideration, in increasing order of controversy:

 * rename Bandit to Whiplash
 * extracting session behavior into independent methods and cleaning up method signatures
 * dividing methods into public/protected
 * extracting some behavior into Test and Goal classes