Unless I'm mistaken, session information is not directly available to
a model. You could hack together some validation in the controller
(not recommended), try sending the session info to the model via a
function, or better yet, find some other place to store this info.
Kyle's right -- you're out past thin ice here. 'session' is a
controller issue that's not really related to your domain (models).
It's much too fleeting.
What model is validating its 'points'? How is it related to user? I
think if you start working down that road you'll find a solution
that's workable (ie., validate directly or indirectly through user).