Sessions can identify user but still not checking password; anyone can log in