You never put password and userId to session. Why do you remove them?