comparing saved hash code to user input. returning false incorrectly, but ajax requests move through the system.
comparing passwords correctly