observable session
automatically save the session when it changes via `Object.observe()`. maybe opt-in. would especially be useful if we make `session` a context property instead of middleware. in this case, we should set the `overwrite` option to `cookies` as true.

we should also make sure to throw if the user changes the session after `.headerSent`.
