...which raises a question: when do we automatically cleanup sync sessions that are stalled?  Imagine my browser creates a new sync session with your server, but half way through, crashes.  That sync session should probably expire eventually so it doesn't hold a lock on that user's sync capability forever.  Likely the `Sync` object can do that by using a timeout, which gets reset every time we call some function in these steps.  One way would be for us to do `Sync.setState(currentSyncState)` in each of the api routes, and that could let the sync object know that it needs to stay alive longer.