I found this out today.  If you want to access the Session from an HttpHandler, you need to implement one of two interfaces.  Either: IRequiresSessionState or IReadOnlySessionState.

Those interfaces don’t have any members but by implementing them you are allowed access to the Session.