added hash value for session_key -- this means that the authen method will first try to authenticated against the session_key and if that fails it will authenticate against the password.
Changed paths: