Do not set session user if not logged in and remove when logged out.
Implement methods to login user without password.