Koa application context should not be mutable during a request
I had the following issue, which may or may not be a bug, but can lead to unexpected behaviour:

On application startup, I setup a specific key on the context:

```js
app.context.myKey = {
    db: ...,
    logger: ...,
    // etc.
}
```

Then during the request, I add additional, request-specific properties to the context:

```js
ctx.myKey.user = await loadUser();
ctx.myKey.sessionId = sessionId;
// etc.
```

In development it works because I was testing one request at a time, but as soon as it went live with multiple users connecting, it became apparent that session data was shared between users. In fact you could refresh the page, and see the data of other random users who were accessing the site at the same time.

Then I understood my mistake - when I add stuff to `myKey` in the request context, I'm actually modifying the application context itself, which then shares that with all the other requests.

I've fixed the issue in my app but I still think this is unexpected - I have a request-specific context, so I thought I could safely modify it. 

I'm not sure if it's a bug but I assume it can lead to dangerous situations where state is unknowingly shared between requests.

As a solution, perhaps the app could somehow freeze all the application-specific context keys? That way an error will be thrown if a request tries to modify it. Or at least a warning should be added to the context documentation to make it clear that the app state is not immutable and could be changed by any request (and that users should avoid doing this).