Yeah good point actually.
I guess im trying to never store the users password in either the file or in the cookie.
Just trying to figure out now to do it, so if anyone hacks either the cookie or the file, they'll never end up getting the original password.
Thanks! that's helped