Reworked how the decoder argument works - it's actually required on a few other
methods but wasn't there, specifically what happens when you need a decoder but
you call service.get_auth_session() and it defaults to not passing a decoder to
session.get_access_token()?  It breaks.

Yes, you can replace the call to get_auth_session() with get_access_token() and
get_session(), but why have the shortcut method if it doesn't work in all
cases?

So what I've done here is added a parameter to the Session object itself, so
you can set it once and forget it for good.