Never ever store their password in a public location. It's perfectly safe to store other session data in a cookie, so long as the authentication doesn't take place directly from the cookie to the application.

Just out of curiousity, what is this about popups in IE killing sessions?
-m