That's new to me as well. Much of that code is cut-n-paste from the article on session handling referenced at masonhq; I hadn't even noticed it.
It turns out to have been the numeric compare of the password variables, though.