Your session state by default is being maintained InProc (in memory in the
web application). Once your settings in web.config changes, your running
web applicaiton is no longer consistent with the config settings, so ASP.NET
shuts it down and brings up a new on to replace it (with the current settings).
So, when it shuts down your in memory state (like session state) is lost.
Consider 1) not using session state at all. There are many ways to build
an app, maintain state and not store it in session state. Or 2) Configure
session state to use the StateServer NT Service, which is an out of process
app that holds session state such that the state will survive a application
restart. You can also store this data in SqlServer, but for your needs, I
imagine the StateServer Service is sufficient.