This hack re-encrypts passwords in the database and in the auto-login cookie, so that attackers can't login even if they got the user's password hash (usually attackers login via the auto-login cookie if they got the password hash). This hack aims to make it difficult for an attacker brute force a password.