Now $user->pass already changed and didn't match with $this->hash($password).