I ran into a nasty performance problem recently.  It involved some AJAXy type dynamic requests.  The problem was that two requests always seemed to be occuring serially rather than taking advantage of the wonders of a multithreaded server and running in parallel.  After much spelunking and debugging, it suddenly occurred to me that the handlers were marked with IRequiresSessionsState to pull a trivial piece of information out of the session.

You may not be aware, but accessing the session usually results in an exclusive lock.  Normally, this isn't a problem since users very seldomly open multiple windows or send simulataneous requests, and sessions usually represent unique users.  But fire off two simultaneous requests, and they will be processed serially.

But, if you mark your page as being "ReadOnly" (or disabled) via the EnableSessionState attribute of the @Page directive (or IReadOnlySessionState for IHttpHandlers), you'll help yourself out.  ReadOnly will get a reader lock on the state, allowing multiple readers access, while disabled (via "false") will not lock at all.  In addition, if you're running your session state out-of-process, disabled will keep you from incuring a hit from the db or other store access.

Just an interesting bit of information that thought would be useful.