Per-password permissions are basically the RBAC design pattern [1], which at it's core requires 3 tables with 2 N:N joins in a relational mapping structure (the wikipedia article lays out 4 classes/tables).

That's a lot of complexity compared to a simple session-authenticated validation.

[1] http://en.wikipedia.org/wiki/Role-based_access_control