Sessions are independent of passwords