improved handling of wrong password hashing input data
cleanup session handler for deprecated stuff and add DB-based session timeout