Reworked how the decoder argument works

The decoder argument is actually required on a few other methods but wasn't there, specifically what happens when you need a decoder but you call service.get_auth_session() and it defaults to not passing a decoder to session.get_access_token()?  It breaks.

Yes, you can replace the call to get_auth_session() with get_access_token() and get_session(), but why have the shortcut method if it doesn't work in all cases?

So what I've done here is added a parameter to the Session object itself, so you can set it once and forget it for good.  I thought about adding it just to get_auth_session() but do we really want to be passing methods arguments then they could just as easily be set on the class?