Add missing else statement

Without this else statement the call to exports.User.verifyPassword() will be made AND the call to return done(err,false).