I use a master password, enter a password in the session form, ensure "Save password (protected by master password)" is ticked when saving the session. It prompts me for the master password and saves the session.
I can now connect without it asking me for the session (or master?) password. However after restarting WinSCP all saved passwords are lost.
Having checked the INI file (I use this over registry for roaming ability) the password tag on all the sessions is blank.