Use a more descriptive password validation message.
Fix logout and session writing.