Deletes cred file when bad password given.
Now uses sessions instead of passing a cookie around.