It doesn't appear that merely cloning a login session cookie would get you access to the password, as it does not appear that the server even knows what it is. In fact, this approach they've used seems like it would allow for password challenges whenever Pandora wanted to, which makes session stealing far less effective.
The default and most secure setting is to not save passwords.
While true from a systems vantage point, it isn't really true once you bring in the human factors. It just isn't reasonable to think people will type in distinct and secure passwords for each of their IM accounts each time they start up their client. It's far more reasonable to have a password manager which manages which applications have access to which passwords, and which stores the passwords all protected by a master password (ideally with two factor authentication).