Better support for overloading start and destroy methods in Session

Move functionality from static start and destroy functions into instance
methods, allowing these to be overloaded. This works the same way as
calling Session::set() which then in turn calls inst_set()

Additionally use Injector to create the default Session instance to
allow the class to be swapped out.
I believe the intention is to start an existing session if you know the ID already.

I thought it should pass the returned ID from request_contains_session_id() into Session::start(), but it doesn't seem to be. This stuff is pretty confusing.