secur32: Avoid double HeapFree() of password and session key.