Changes to public-facing session object

- Change from list to environment. This enables the next feature:
- Make $request a promise. websocket$request breaks on some (earlier?) versions
  of httpuv. I'm not sure why this is but in the few hours since I submitted
  the websocket$request change we've had a number of complaints. This way the
  error only occurs if the app actually asks for session$request.
- Make the private session object accessible via `.impl`. Obviously any data or
  methods on the private session object are unsupported but they are there if
  you are desperate and don't mind possible future breakage.