session: cleanup properly and add password capability