only set session when password correct in admin