differenciate between continued and password-authenticated sessions to secure against cookie hijacking