I found this out today. If you want to access the Session from an HttpHandler, you need to implement one of two interfaces. Either: IRequiresSessionState or IReadOnlySessionState.
Those interfaces don’t have any members but by implementing them you are allowed access to the Session.
Chris May 
And be sure to include the check If(HttpContext.Current.Session!=null) before using session, as some handlers might not have session enabled, and trying to access session from them will throw a “Session state is not available in this context.” exception. See http://siderite.blogspot.com/2009/01/session-state-is-not-available-in.html