cancelSession erases the TransportSession under the Baton's mutex.  If that session has an outstanding Promise, however, it will try to break that promise, which in turn schedules the corresponding Future to run (and resolve with a BrokenPromise error).  But scheduling the Future to run requires locking the Baton's mutex.  This results in deadlock.

Instead of destroying the TransportSession under the Baton's mutex, we should move the TransportSession out of the Baton's _sessions map under the mutex, the release the mutex before actually destroying the TransportSession.