Get session state after lock acquiring, release session on error

[heliheli]

Fixed 2 bugs:

1. if IServerRoSessionData.setServerRoSessionState relatively slow, we cat get outdated state before lock and process request with incorrect state
2. if server receive CCR-U/CCR-T on non-existent session (unknown session-id), he creates session in LocalDataSource.sessionIdToEntry, but never removes it