use a session password that differs from some other env
use .env for SESSION_SALT
set tabindices on password inputs
clear all sessions when a user changes password