How is my password stored?

As a scrypt hash, never as the password itself. Sessions are a random token in an httpOnly cookie; the database keeps only its SHA-256.