“Its not stated here what the password
field is used for, or why it is
required. I was told by an Adobe
employee at CFUnited 2008 that it was
used to recreate the login in
clustered environments. An explanation
of this process might be useful.”
– http://livedocs.adobe.com/coldfusion/8/htmldocs/Tags_j-l_08.html
So actually why does <cfloginuser> require a password attribute??
Password is used for the base64 string
see: CFLogin Security Considerations
But why is the password needed for the base64 string? I don’t know…