Shouldn't you try to change the password and catch a SRPAuthBadPassword exception? If you do so, I think there's no need to expose the check_password method in srpauth.