The session data never has the password hash.