session lifetime is an orthogonal concern to the password. i just don't see it as a good idea to have the password be one of the inputs to the value of the ses

session lifetime is an orthogonal concern to the password. i just don't see it as a good idea to have the password be one of the inputs to the value of the session identifier in any way, which was my point. you can handle every scenario you bring up without tying password to session id.