Change of API to support unit testing using the Jersey InMemory
container.  @Context on the HttpServletRequest is not suitable for class
level injection [1].  

Now we inject a Session for each request, which means we can nicely unit
test.  

However, we now have an issue that any problem with the Session building
will be done before the method, and thus we can't set the detailCode on
the exception as required by DataONE.  An RFC has been submitted to make
that optional.

[1] https://java.net/jira/browse/JERSEY-623