The core problem you're having here is injecting a Session-scoped bean into a Singleton. This can work, but you need to do a little more configuration.
See, singletons get injected once, at startup. This obviously won't work for session/request scoped beans, since the session isn't available until the request itself is issued. The solution is not to inject the scoped bean, but a proxy to that bean (that will be resolved when the actual call is made).
With XML, you'd just add a <aop:scoped-proxy/> tag to your scoped bean definition. You can't really do that with annotation-driven configuration, though. Instead, if you set up your component scanning like this:
Spring will automatically create proxies for all scoped beans discovered through component scanning. This should enable your code to work even with a @Scope("session").
<context:component-scan base-package="your package" scoped-proxy="interfaces"/>
Hope this helps