I was trying to do something similar with an ISAPI filter and was able to get a reference to the SessionObject in the filter by passing a reference created with the OBJREF moniker back to the filter within a Header.
However the only usefull property I could get back from the object was the sessionID. I could not read any properties (i.e Session("xxx") in the filter as the object was clobbered in some way. When calling these methods durring a page request within a COM object they worked fine.
The Application object does not have this problem (I think this is due to a compatible threading model or something like that) and you can get and set values within it from inside an ISAPI filter. If you set application variables like Application("Session": & Session.ID) = "xxx" you can happily read these from within the filter.
At
http://www.johnno.com/code/ you can find the work in progress which includes two projects, one being the ISAPI filter and another being the COM object which creates the object reference. If you register the COM object and install the filter onto a new demo virtual server in IIS, the demo content in the zip shows a filter protecting a directory until a variable of Application("Session: & Session.ID) is set to True.