`password` was never actually stored into session anywhere, so I re-purposed it.