The session isn't a particular safe place to store unencrypted user credentials