obfuscate AuthString as well as session in auth structures