App multiplexing router can create invalid sessions

It creates an empty session and only adds the `state` entry (which it assumes will always be present) later. This leaves a window during which other workers can read an invalid session.