flip comparison in http_auth so BCrypt::Password can be used