When session store not ready, just return 500

When session lose efficacy, almost every server will just 500
but if you just call `next()`, not everyone know `req.session`
can be empty, and their servers will crash by using `req.session.key`