psynaptic raised this issue.

From password.js:

  /**
   * Define an alternative to bind function that will delay execution.
   */
  $.fn.bindWithDelay = function(type, data, fn, timeout, throttle) {

    if ( $.isFunction( data ) ) {
      throttle = timeout;
      timeout = fn;
      fn = data;
      data = undefined;
    }

We don't know for sure that undefined hasn't been tampered with. We could define undefined in the arguments list of the IIFE's inner function (first line in file) and not define it in the outer one (last line in file). That would ensure undefined is exactly what we expect.

$ could be anything, it's just convention we call it $ because that's what we usually use for jQuery, because it's a local function scope. now, if you pass in say window at the bottom
(function($, w) {})(jQuery, window)
(function($, w, undefined) {})(jQuery, window)

https://stackoverflow.com/questions/8275658/passing-window-and-undefined...
http://nicoespeon.com/en/2013/05/properly-isolate-variables-in-javascript/