session timeout augmented
password as composite component