In other words, SHA1 (password) becomes the actual password. As the author writes, "hardly an exploit": just a gentle reminder how insecure the default auth is.