Where to put new objects generated by middleware?

PSR-7 is going to be standardized soon (I believe). That's got me thinking about middlewares, such as used by Phly, StackPHP, and ConnectJS.

The way ConnectJS works is that it modifies the request object when a middleware needs to add something. For example, cookie-session creates a session property on the req object:

app.use(session({
  keys: ['key1', 'key2']
}))

app.use(function (req, res, next) {
  var n = req.session.views || 0 // <-- req.session is managed by the session middleware
  req.session.views = ++n 
  res.end(n + ' views')
})

With PSR-7, both our Request and Response objects are (supposed to be) immutable, so how are we supposed to pass along additional data like this? Where would be the best place to store a 'session' object like this, for example, or a 'user' object created by an authentication middleware?