Wait, you just made the opposite argument. The string "[password]hello" sensor-compared to "hello" is true. That means it IS comparing the output of [password] not the input (which must be null). Because as you can see, those strings are NOT the same.
But comparing "[sector]" with "2,2,2" fails...