The password is compared server-side against COMMANDOS_PASSWORD and never stored in the browser.