Correction:
I forgot one of the most important things for this code. Because it is working at Session_Start(), we must include a Session.Abandon() so the session is not established. Without that statement, the client would be denied access on his first request, but would be able to access the...