Explain why we look for passwords in $CWD first

The logic added in I30a2cc4f406122bb038d314a277c2444182bd0c9 is not
always entirely clear to people reading the code, which has led to some
confusion when other people are working on the same code.

This change adds comments which attempt to explain the logic being used
here, and mention some of the reasons why we want this behaviour.

Change-Id: I12d013196b0c533a0550167b9b8209e590e3bd49
Merge "Explain why we look for passwords in $CWD first"