As for the password, if I were you I would indeed encrypt it.
Adding a simple md5 should so, add one to the "register" form (guessing this is in the install script), and add an md5 hash to the password before it gets verified. (so basicly add $password = md5($password) before your password checking conditional

)
Good luck! I personally find cookies and sessions a pain in the neck aswell, heh.