Cigi{Incoming,Outgoing}Message can only be constructed sensible by CigiSession (it's the only friend class that has access to SetSession()). Attached patch makes the ctor protected reducing the chance for misuse of the API. Patch against r814.
Patch
Patch