specifically require user password for session identification