I still don't agree with this reasoning.  I think the right path is to have a handler which uses this constant to expose the user profile in the request registry rather than expose the session constant directly.