fix session storage of auth details (use hash everywhere)
work towards #4