removed password session variable