How to best accomplish this

[Alexandre Machado]

I believe the problem is that I am using an older version (15.2.50) of Intraweb 
I am going to update but have a number of TMS IWcomponents that are a bitch to install.
Is there another work around for my Version?

Code:

//This access Violates on the  webapplication.Terminate('hello');
procedure TIWServerController.IWServerControllerBaseBeforeNewSession(
  const aUrlPath: string; aRequest: THttpRequest; out vCanCreate: Boolean);
begin
    webapplication.Terminate('hello');
    VCanCreate:=False;
end;

// this works
procedure TIWForm14.IWButton1Click(Sender: TObject);
begin
  webapplication.terminate('test 123');
end;

The AV happens because there is no session yet and you are trying to reference an object that hasn't been created. Your code is not correct.

Besides that you should reconsider this custom response message: 
If you are blocking the access then you are certain that this is an unauthorized access. So why are you sending a "nice" response back?? It's like a burglar trying to enter into your home and you are asking him gently to go away...
The standard procedure in any web framework or application out there is to respond with either 404 (what IW does by default) or something even more specific as 401 (Unauthorized). You can use the property SessionOptions.HttpStatusForDeniedSessions and change it to whatever you want (I recommend leaving it the way it is or changing it to 401).