I've seen applications which re-check the password at your "checking login" stage, presumably on the assumption that users might log in at one computer, forget to log out and leave it vulnerable, like in an internet café?

Logging in somewhere else and changing the password kills the first session.