Do not use global sessions

Each time a mongo interaction is performed, the session is copied using session.Copy() to ensure a fresh socket is used if needed. The basis of the change is to remove the "global" mongo collections on state.State and refresh each time one is used. A similar approach is used with the transaction runner.

The changes essentially follow the mgo driver guidelines:
newSession := session.Copy()
defer newSession.Close()
<do stuff with newSession>

During bootstrap, state.State is created using a session that has not had Login() called. For this case, the session is not copied as there are no stored credentials yet. An authenticated bool is added to state.State for this purpose.
is or must be called ? What happens if we fail. Should you use a finalizer to catch failures to call session.Close ?