Better support for overloading start and destroy methods in Session

Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
Any side effects here caused by changing how Session::start works? This will now call Session::current_session, which will instantiate a session in Session::$default_session object, and then merrily continue to create a new Session via injector below and pass that one to the controller. 

I think beforehand Session:$default_session object might have never been set, and here the $default_session could pop up at some later, unpexpected time.

What do you think?