Really, damn!
And changing the key is also impossible?
I can't understand what's the big deal of including some lines to add a simple password method.
O.K., but when someone has the key and there's no password. What is the deal about "killing" the session, if he/she could login after 1 Min. again?