destroy_session uses the session and client without continuously holding
any reference or locks.

Put the whole thing under the state lock for now.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>