Session state supposedly is disabled by default in MVC ApiController, indeed HttpContext.Current.Session is null, however in load testing I'm seeing these exceptions ...