Always set a session key, even for the 'no password' case.