'middleware.validateSync( Sync )` <-- don't do this.  I guess this is why you put the sync instance on the session?  Instead of this, use the `syncID` that's been passed on the URL to get the sync session from the Sync object calling a static method.  Do that in the `validateSync` middleware, and you don't need to store anything on session.