Ive seen a legacy application still in use which puts the password in a (non-secure) cookie as ROT13 and cleartext in the db.