remove password

the password was removed right after the login was done, which at some point, is more secure, but very annoying when login fail during some step that is processed later. So I moved this after the very last code that is executed during login. In case of failure the password is now restored, in case that login is completely finished it is removed from the memory.