Because the applet produces a digital signature from a cryptographic key on your hard drive. This is much more secure and scalable than sending the password, see [1] and [2].
An alternative solution would be to use an SSL client certificate[3] or the WebCrypto[4] API (still under development).
