Switch to use a request decoration instead of request.auth.session

See: https://github.com/hapijs/yar/issues/88

I am removing the `request.session` and `request.auth.session` placeholders from hapi. Should not break anything but you should consider a breaking change to move the methods set by this plugin elsewhere directly on the request.
