buyservice page saves credentials in session

[dmora4]

confirmation page checks 1) if there are crednetials and 2) if crednetials are correct: this decides whether to show buy button or login/reg

[dmora4]

ISSUE: for security, the password of the user is NOT saved in server side (nor client side) storage. HOW do we check credentials again in the confirmation page is we do not have the password saved? should we just rely on the client side boolean "is logged in"?

proposal: make the boolean server-side that way a malicious user cannot alter the page without valid credentials