Shouldn't that be pin and not pass? You fetched the pin hash above and now compare a pin hash with a password hash. Should never match?