Fix missing session bug in access control guards

Racer doesn't add a `session` property to the `req` object when the client is requesting a snapshot update. This causes problems (see #37) when during a snapshot request an access control guard tries to decide whether the client is allowed to do something based on the session.

I found that adding the line in the pull request fixes the issue for me.