main.js: deselect password from GET /session.