store credentials in session var. will convert to https only when we go live