osd: fix a session ref leak, and an unlikely race