WebAPI Authentication
In general, you want to give as little information as possible for why access was denied.  So I would change that section of code to:

if (session == null || session.Expired)
{
    throw new SecurityException("Access Denied");
}


Presumably this exception gets converted to an appropriate HTTP status code.

SendAsyc is an odd name for a function that enforces security, but maybe you have a reason for that.  That said, it seems like there's something missing since I don't see where it is async or returns a Task.