If you are going to try to access Session variables from Global.asax, you need to make sure you use an event that is fired after Session has been initialized for the current request. If you take a look at the documentation on MSDN, you'll see there are several events you can wire up in the Global.asax (check out the list of events in the section "The request is processed by the HttpApplication pipeline").
If you wire up those events, you should find that Session is initialized before Application_AcquireRequestState is raised. If you move your code out of Application_AuthenticateRequest and into Application_AcquireRequestState then it should work properly.
Note that I used the following code to test when Session would be initialized (C#, sorry). I wired up each event in order from the documentation, and Application_AcquireRequestState was the first event where I saw session == null evaluate to false.
void Application_AcquireRequestState(object sender, EventArgs e)
{
var session = HttpContext.Current.Session;
Response.Write("Application_AcquireRequestState: -> session is null: ");
Response.Write(session == null);
Response.Write("<br />");
}
SetPermissions()method getting called from an HttpModule that is running beforeHttpContext.Current.Sessionis initialized?