I need to revisit `crypto/password.js` because that whole thing is confusing. It does in fact return the verifyHash in this case, so for now I'll leave this.