I found this out today. If you want to access the Session from an HttpHandler, you need to implement one of two interfaces. Either: IRequiresSessionState or IReadOnlySessionState.
Those interfaces don’t have any members but by implementing them you are allowed access to the Session.