Make res.locals.state *always* inherit from app.locals.state

With this change if a request comes in before data is exposed at the app-scope, the `app.locals.state` object will be created first. This ensures the semantics of the relationship between app- and request- scoped exposed data.