The session bean has passivation and activation methods. These are called by the container if there is a need to free up resources. Once passivated, the bean should be capable of being serialized by the container, and once deserialized, the activation method should restore the bean to a condition indistinquisable from its pre-passivation state.
Without actually checking the spec, I don't think that the passivation/activation mechanism is required to use
Java serialization. I think that's left up to the container implementer.
Despite the name, "session" EJBs have no relation whatsoever with http server sessions outside of the fact that an http session can contain EJBs in the same way it can contain other Java objects.