The kata's description says "Utilize the comprehension syntax in the following exercise"

it might be, that the passed function invokes the function again.

e.g.

myDiv.onclick = once ->
  console.log "hello world"
  myDiv.onclick() # recursive loops ftw, all your CPU are belong to us

would run the myDiv.onclick more than once if you place shouldRun = false AFTER executing the function. This is why you should place it first.

should be lastIndexOf

This would be considered a security flaw. Some name-password combinations could match, even if they are wrong (e.g. name = "Santa", password = "Claus Ho Ho Ho!").
This isn't a huge flaw, but it is one, and in IT security there is often little tolerance for such mistakes.