\OCP\User::checkPassword($user, $password) returns the username, the return value should be used.