Move storing password/username after checking password

The cookie encryption is quite expensive, so let's move it after we
check password validity.

Signed-off-by: Michal Čihař <michal@cihar.com>