Why is this 'necessary'?  The mcrypt_encrypt used to store the password in the session is reversible.