The global application class that's used by the global.asax file should always be stateless.
You can handle two types of events in the global.asax file:
Events that always occur for every request.
Events that occur only under certain conditions.
BeginRequest() called at the start of every request, including requests for files that aren't web forms.
AuthenticateRequest() called before authentication is performed.
AuthorizeRequest() assigns special privileges.
ResolveRequestCache() is used in conjunction with output caching.
AcquireRequestState() is called before session-specific information is retrieved for the client.
PreRequestHandlerExecute() is called before the appropriate HTTP handler executes the request.
PostRequestHandlerExecute() is called just after the request is handled.
ReleaseRequestState() is called when the session-specific information is about to be serialized from the Session collection.
UpdateRequestCache() is called before information is added to the output cache.
EndRequest() is called at the end of the request.