Isn't the solution really easy? Make the students show up on the first day in-person, compare.with ID and take a photo.
Deleted Comment
So the only remaining issues are security issues around sharing your computer with other people, or programs. I guess stealing a session id is mildly less problematic than stealing the password in case the password is re-used elsewhere.
After initially setting a password, the database/server should only store a salted hash.
No exceptions.