Better support for overloading start and destroy methods in Session

Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
Session::start doesn't rely on $this, so I don't think this specific scenario will be a problem. It's more like there will be two session objects floating around - one tied to controller and the other tied to Session::$default_session. 

This doesn't seem to be a problem for Director, because it sticks to that local $session object, so should inst_save the right thing. I'm thinking more about situations like if the Controller pops itself off the stack, suddenly exposing the initial Session::$default_session that could have some weird data in it coming from who-knows where.

If anything it has a potential for some weird edge side-effects.