How does verifying the password fail? Have you logged the values that you get for $pword and from the database?

Also, why are you looping over $cgi_object->param() and checking the password inside that loop every time? Is that maybe your error?