Right, which is why session state should be kept on the client, and why the client should manipulate application state (i.e., everything that lives in a databas

Right, which is why session state should be kept on the client, and why the client should manipulate application state (i.e., everything that lives in a database) using a well-defined RESTful interface. The approach in the OP seems to conflate these two types of state. The end result is application state without a well-defined client interface, and session state which is passed backed and forth to the server.