Currently, during the session, the user's master password is being stored as a variable by the Python server.
The ideal method would be to encrypt the master password during the session with a randomly generated key and then store the encrypted password in a remote SSL service. Only access the master password when it is needed.