avoid closing sessions manually

the session object is now accessible through 
- request.db
- config.registry.dbmaker()