Spring Security - Use session/user attributes to restrict access?

Question

We are trying to build a "lock screen" for a web app that uses a different way to log back in (short PIN instead of Password. Our idea for this is to save a session at