Do not use user password to build authentication cache key. Use sha1() instead of md5().
Reasoning:

• This way it's more secure.
• Password change does not really invalidate the cached username/host.