app: let app instance creation remove its SA Session when done

The app instance is usually created early or on demand before serving the first
request, and the app instance might sit idle for a while before receiving the
first request. The app creation will touch the database, and we have to
consider the lifetime of the database session it is using. The cbf524e4c1a3
commit message gives some reasons we should remove the session when done.

But instead of handle it inside utility functions, we would rather handle
sessions at a high level as here.