SecurityContextHandler with session handling.