Weren't we passing the email in the query string, or did that change to {session,local} storage?
I'd be a bit concerned by passing a password (encrypted or not) in a query string. Session storage may be OK as long as we delete it immediately on the /signup page.