code: public static final boolean passwordMatches(User u) {
  		if (u == null) {
  			return false;
  		}
  		String password = u.getPassword();
  		String identifier = u.getIdentifier();
  		if (StringUtils.isBlank(password) || StringUtils.isBlank(identifier)) {
  			return false;
  		}
  		ParaObject s = CoreUtils.getInstance().getDao().read(u.getAppid(), identifier);
  		if (s != null) {
  			if (s instanceof Sysprop) {
  				String storedHash = (String) ((Sysprop) s).getProperty(Config._PASSWORD);
  				return Utils.bcryptMatches(password, storedHash);
  			} else {
  				LoggerFactory.getLogger(User.class).
  						warn(Utils.formatMessage("Failed to read auth object for user '{}' using identifier '{}'.",
  								u.getId(), identifier));
  			}
  		}
  		return false;
  	}
docs: Checks if a user has entered the correct password.
  Compares password hashes.
  @param u a user with a set password
  @return true if password matches the one in the data store