function PasswordChecker(accounts) {
    return function (user, password) {
        var passwordHash = Q.get(accounts, user);
        return when(passwordHash, function (passwordHash) {
            if (hash(password) === passwordHash)
                return true;
        };
    };
}

// returns a password checking capability
// but does not return access to the passwordHash
return PasswordChecker(accounts);