I have a generic handler to return EPiServer content as JSON. 

I'm using DataFactory.Instance.FindPagesWithCriteria() with criteria to return the content, this is fine, however, I would also like to use FilterForVisitor to filter out content for the current user. Calling FilterForVisitor.Filter() inside the handler doesn't filter out content for the user. I've enabled IReadOnlySessionState for the handler as I thought the session info would contain who the user is but this doesn't work.

Is there a way to programatically retreive the 'user' and filter content for them? Or should I just alter my criteria to only return the content I want? If so, what criteria do I set to not display contnet with 'Display in Navigation' unchecked?