code: func (htpasswd *htpasswd) authenticateUser(username string, password string) error {
  	credentials, ok := htpasswd.entries[username]
  	if !ok {
  		// timing attack paranoia
  		bcrypt.CompareHashAndPassword([]byte{}, []byte(password))
  
  		return auth.ErrAuthenticationFailure
  	}
  
  	err := bcrypt.CompareHashAndPassword(credentials, []byte(password))
  	if err != nil {
  		return auth.ErrAuthenticationFailure
  	}
  
  	return nil
  }
docs: // AuthenticateUser checks a given user:password credential against the
  // receiving HTPasswd's file. If the check passes, nil is returned.