The auth check does bcrypt compare, but then doesn't check the `match` variable to see if it's true or not! bcrypt will return `match=true` if the hashes match and `match=false` if they do not.