encrypt source properties with key = hash(salt+password), save key in (encrypted) cookie. This should ensure that if server is compromised, no data sources are compromised at least until users re-login.