[petedoyle]

Maybe they wanted some cached data to get invalidated if users change their passwords?

[duskwuff]

Then use some other data which can act as a proxy for that, like the date of the last credential change. Using the password itself is a terrible security smell.