The is-this-still-valid shouldn't be needed.  If it's valid, the user will be logged in.

The session_id vs user/password and whether to save the user/password is more tricky.  If you take a look at what the current code does, I don't think we're changing things much here... we're simply adding a strategy for dealing with otp+passwords to the equation.  But the current strategy which has persistence of the password maybe should be changed.  We should probably discuss this aspect on IRC to decide what we want to do and whether it should be part of this pull request or a separate one.