[Zope] REQUEST.SESSION

Hello again, First: Is there a way to prevent access to files in the server (pdf files, for instance). I intend to use sessions (REQUEST.SESSION) to control that. Is it possible? If not, what's the better option in this case? AccessRules also don't seem to work. Second: I'd like to use Session (REQUEST.SESSION) data as a parameter to another method (a Zsql Method for example). How can I do that in dtml? <dtml-with SESSION mapping> doesn't work. I guess I should use getSessionDataByKey, but I didn't figure out exactaly how. Can anyone help me? Thank you very much.