simple security enhancement for doing auth for jabber without storing user passwords in session