As lachoy said, I think application logic like session handling should be done outside of TT. You should do this in your perl code and then call TT, passing in the data that you want it to display.

I'm kind of opposed to the existence of Apache::Template, since it leads people to try and shove all of their application logic into the templates instead of in perl code where it belongs. However, there is a better way to use Apache::Template that provides more separation. You can subclass it and add your application logic (in this case session handling) in your subclass. Take a look at TT2ServiceModule and the information there about subclassing.