found and plugged a security hole;http and socket now can share session data;never send or store even the md5 hashed pw can be used to login