No, that doesn't sound terribly secure, does it?
But then, he may not have implemented it yet; he could just be testing the login at this point...