Returns the session the middleware loaded for this request.

This is the single entry point: the middleware, route handlers, the CSRF middleware, and framework bridges all read the same instance, so no caller can observe a differently-configured session.