Less thread-unsafe, but still a lot more code to review.

We use a shared_ptr for sessions, so they don't go away while we're still using them.