Move model definition to a shared package with client
Add some explanation about password hashing
Fixed bug where session was unintentionally removed