The restrict access server behavior should use the trigger "before page loads" by using the trigger of the session variable it won't restrict access properly since that session variable won't exist so the check will never trigger.
Your friends over here at WebAssist! These Dreamweaver extensions will assist you in building unlimited, custom websites.
These out-of-the-box solutions provide you proven, tested applications that can be up and running now. Build a store, a gallery, or a web-based email solution.