remove password hash code so we don't depend on this module anymore
fix error in cookie auth when the cookies don't exist
auth user from id, as username may change