Set auth_success to False before attempting the authentication.  Otherwise it appears this example would get a NameError when it attempts to return auth_sucess if the user_record was not found in the _AUTH_DB.

Set auth_success to False before attempting the authentication.  Otherwise it appears this example would get a NameError when it attempts to return auth_sucess if the user_record was not found in the _AUTH_DB.