changelog and docs for #597
no module-global session (#597)

This might have been perfectly correct, but I read that requests.Session
objects share cookies between requests. That makes me nervous for two reasons:
- thread safety (does requests lock the cookie jar internally? who knows?!?)
- leaking cookies could have privacy/performance implications; we don't need
  'em anyway