Session can be stolen when route dies

This is issue #4 - it's actually a session stealing problem.

If the route code dies, the cached $SESSION variable is left around and picked up on the next request.