remove password hash from session object