Rename Session::start() to create().

This is what it does, actually. And this avoids confusion (that at least I had) with the functionality vs. session_start().
Don't send cookies when we write the session.
Stop using a shutdown handler.

You cannot set cookies when the headers have already been sent. The shutdown handler ensures that sessions get written on a fatal error that prevents the normal shutdown, though.

I'm not convinced at all that this is a good idea.