[#7688] Use username instead of userid in session. Handle expired
password after logging in.