code: func (s *AuthServer) CheckPasswordWOToken(user string, password []byte) error {
  	const errMsg = "invalid username or password"
  
  	err := services.VerifyPassword(password)
  	if err != nil {
  		return trace.BadParameter(errMsg)
  	}
  
  	hash, err := s.GetPasswordHash(user)
  	if err != nil && !trace.IsNotFound(err) {
  		return trace.Wrap(err)
  	}
  	if trace.IsNotFound(err) {
  		log.Debugf("Username %q not found, using fake hash to mitigate timing attacks.", user)
  		hash = fakePasswordHash
  	}
  
  	if err = bcrypt.CompareHashAndPassword(hash, password); err != nil {
  		log.Debugf("Password for %q does not match", user)
  		return trace.BadParameter(errMsg)
  	}
  
  	return nil
  }
docs: // CheckPasswordWOToken checks just password without checking OTP tokens
  // used in case of SSH authentication, when token has been validated.