initial 10

secured a bit user password stored in session cookie