diff --git a/VERSION b/VERSION
index 254863b0..5f367555 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.0.9 (2012-09-30 00:23:07) dev
+Version 2.0.9 (2012-09-30 07:26:14) dev
diff --git a/gluon/dal.py b/gluon/dal.py
index 88599ac9..ef9df5c3 100644
--- a/gluon/dal.py
+++ b/gluon/dal.py
@@ -6577,16 +6577,15 @@ class DAL(object):
         if 'singleton_code' in kwargs:
             singleton_code = kwargs['singleton_code']
             del kwargs['singleton_code']
-        else:
-            singleton_code = hashlib.md5(uri).hexdigest()
+        singleton_code = hashlib.md5(uri).hexdigest()
         try:
             db = thread_local.db_instances[singleton_code]
             if args or kwargs:
                 raise RuntimeError, 'Cannot duplicate a Singleton'
         except KeyError:
             db = super(DAL, cls).__new__(cls, uri, *args, **kwargs)
-            db._singleton_code = singleton_code
             thread_local.db_instances[singleton_code] = db
+        db._singleton_code = singleton_code
         return db
 
     @staticmethod
@@ -6641,7 +6640,8 @@ class DAL(object):
                  migrate_enabled=True, fake_migrate_all=False,
                  decode_credentials=False, driver_args=None,
                  adapter_args=None, attempts=5, auto_import=False,
-                 bigint_id=False,debug=False,lazy_tables=False):
+                 bigint_id=False,debug=False,lazy_tables=False,
+                 singleton_code=None):
         """
         Creates a new Database Abstraction Layer instance.
 
diff --git a/gluon/globals.py b/gluon/globals.py
index 5dc5818c..f82a6518 100644
--- a/gluon/globals.py
+++ b/gluon/globals.py
@@ -419,11 +419,11 @@ class Response(Storage):
         BUTTON = TAG.button
         admin = URL("admin","default","design",
                     args=current.request.application)
-        from gluon.dal import thread
-        if hasattr(thread,'instances'):
+        from gluon.dal import thread_local
+        if hasattr(thread_local,'instances'):
             dbstats = [TABLE(*[TR(PRE(row[0]),'%.2fms' % (row[1]*1000)) \
                                    for row in i.db._timings]) \
-                           for i in thread.instances]
+                           for i in thread_local.instances]
             dbtables = dict([(regex_nopasswd.sub('******',i.uri), 
                               {'defined': 
                                sorted(list(set(i.db.tables) - 
@@ -431,7 +431,7 @@ class Response(Storage):
                                '[no defined tables]',
                                'lazy': sorted(i.db._LAZY_TABLES.keys()) or
                                '[no lazy tables]'})
-                             for i in thread.instances])
+                             for i in thread_local.instances])
         else:
             dbstats = [] # if no db or on GAE
             dbtables = {}
diff --git a/gluon/tools.py b/gluon/tools.py
index c465b83c..3d4141c1 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -1710,6 +1710,7 @@ class Auth(object):
         login the user = db.auth_user(id)
         """
         user = Storage(self.table_user()._filter_fields(user,id=True))
+        if 'password' in user: del user.password
         current.session.auth = Storage(
             user = user, 
             last_visit = current.request.now,