Function verify_password 

pub fn verify_password(
    stored: &str,
    password: &str,
) -> Result<bool, PasswordError>

Verifies password against a stored hash, in constant time (ring::pbkdf2::verify compares that way).

Ok(false) is a wrong password; Err is a corrupt row. Keeping them apart is the point – see PasswordError.