`$hashedPassword` is the hash password form db like the docblock says. `_findUser()` will always passes that value in the call to `_password()` so it's always going to be a non-empty string.