password fix (not reading a variable but a string with the name of the variable).
One call to session save on login (previously multiple calls)