Session IDs are generated, but are not being fixed properly. Passwords
are hashed before sent over the wire.