He's avoiding the double-hop issue by switching the security context. Previously you were doing this:

client -> web server (as Windows user) -> SQL Server (as Windows user)

now you're doing this:

client -> web server (as Windows user) -> SQL Server (as SQL Server login)