code: func (state *UserState) CorrectPassword(username, password string) bool {
  
  	if !state.HasUser(username) {
  		return false
  	}
  
  	// Retrieve the stored password hash
  	hash := state.stored_hash(username)
  	if len(hash) == 0 {
  		return false
  	}
  
  	// Check the password with the right password algorithm
  	switch state.passwordAlgorithm {
  	case "sha256":
  		return correct_sha256(hash, state.cookieSecret, username, password)
  	case "bcrypt":
  		return correct_bcrypt(hash, password)
  	case "bcrypt+": // for backwards compatibility with sha256
  		if is_sha256(hash) && correct_sha256(hash, state.cookieSecret, username, password) {
  			return true
  		}
  		return correct_bcrypt(hash, password)
  	}
  	return false
  }
docs: // Check if a password is correct. username is needed because it is part of the hash.