code: func correct_sha256(hash []byte, cookieSecret, username, password string) bool {
  	comparisonHash := hash_sha256(cookieSecret, username, password)
  	// check that the lengths are equal before calling ConstantTimeCompare
  	if len(hash) != len(comparisonHash) {
  		return false
  	}
  	// prevents timing attack
  	return subtle.ConstantTimeCompare(hash, comparisonHash) == 1
  }
docs: // Check if a given password(+username) is correct, for a given sha256 hash