add mutex to prevent concurrent session state saves.

Why wasn't this done 10 years ago?