Fix #34: check for state error onPreResponse.

If hapi detects a problem with state, e.g. if cookie decryption fails,
the onPreAuth handler will be skipped and request.session will remain
unset. Check if the session exists before handling it.