login now can use session cookie, not need to send User and Pass on every request. Need to remove from client side. Client should not remeber password in memory anywhere, and just use cookie. This is prevent XSS attack via the framework scripting