session: get rid of waitpid() by establishing SIGCHLD watch
session: cleanup properly and add password capability