Remove session handling from the BaseHttpHandler and provide an abstract
class on wish applications can build their Authentication