title: Is really necessary to keep username/password into a SESSION variable?
body: <p>this question is more about a concept than a code issue itself. 
  I'm into some project that need a custom webmail and as I'm a Windows guy, I decided to go in the backend with hMailServer + PHP. But then, it just came the first doubt: hMailServer provides me support for a COM API, which method can be accessed via PHP, that's good. So for login, I could do something like:</p>
  
  <pre><code>&lt;?php
      $obBaseApp = new COM("hMailServer.Application");
      $obBaseApp-&gt;Authenticate("email@privmail.local", "12345") or die('Invalid user');
  ?&gt;
  </code></pre>
  
  <p>To get the e-mails inside the inbox of the current logged-in user, I need to do:</p>
  
  <pre><code>$obBaseApp = new COM("hMailServer.Application");
  $obBaseApp-&gt;Authenticate("email@privmail.local", "12345") or die('Invalid user');
  
  $obDomain = $obBaseApp-&gt;Domains-&gt;ItemByName("privmail.local");
  $obAccount = $obDomain-&gt;Accounts-&gt;ItemByAddress("email@privmail.local");
  $obMessage = $obAccount-&gt;Messages;
  $totalMessages = $obMessage-&gt;Count;
  
  for ($i = 0; $i &lt; $totalMessages; $i++)
  {
      echo $obMessage-&gt;Item[$i]-&gt;Subject;
  }
  </code></pre>
  
  <p>Ok, so let's imagine the following scenario: in the login page, I use the first code posted above, to check if the login is valid... If it's valid, I redirect to the inbox page, where I parse all the e-mails... But to do this, I need to keep username/password saved in a session variable and worst: decrypted! This is the correct way to do this?</p>