It works (or at least seems to), but now I wonder too...good catch. Something like below look good?

```
var valid = password === this.password;
return done(null, valid)
```