pub async fn verify_dummy(password: String)Expand description
Pay the bcrypt cost without having a hash to check, and discard the answer.
Called on every login path that fails before a real comparison: no such user, and a user with no
usable stored hash. Both are false regardless, so the result is deliberately dropped.
An empty password still short-circuits, because verify short-circuits and upstream’s
compare does the same on a falsy input (password.js:24-29). The two branches stay
indistinguishable from each other, which is what matters.