While using Session variables for everything is not a good idea, you can use them sparingly for instances such as login security. A basic security scheme you can implement involves two features:
1) A login page on which you validate the user, by whatever method you wish.
2) Each page that needs to be secured checks a Session variable that is set after a successful login. If the user isn't logged in, redirect them to the first page.
The bonus with this method is that if the user leaves his/her browser open, the session will time out and will require them to log in again. There are other methods of doing security, but this is one you can do without having to get to the IIS console (for those of you on virtual servers that you don't control.)