Using _session authentication with admin passwords