pass on to the next callback if password is not a scrypt hash