Session attributes are aggresively persistant

[heneryville]

Our handling of session attributes is make it practically impossible to remove stuff from the session. In StateMachineSkill line 53 (the onBeforeReplySent handler), the old session, and the result of the data serialize are merged together.

I'm mostly OK with the idea that you've got to delete things explicitly from the session to make them not persist, (though my functional part of me hates this), but that data values from prior request are allowed to clober the next request is not OK. Voxa should enforce that everything the model wants to go to the next session will be in serialize, and it should not merge in the prior data attributes. This is why the original statemachine code used Object.assign here, rather than _.merge.