don't expose passwd in session