use proxies for session data

So that we can check that the store actually exists (#4) and whatever else we want.

``` js
req.session.set('thing.property', stuff)

req,session.get('thing.property')
```

Would be removed of favour of Proxies, eventually. In like a decade when they actually land.

A big issue would be people being idiots and assigning stuff onto the data object or get()-ed objects.