failed to match password from database and user provided in nodejs

This is very basic question regarding node js, I am using angularJS 1.5 as client side and nodejs and mongodb on server side

when I click on login after entering credentails from UI, we check credentials find it into User collection and than match password ( stored vs provided ) as of now I am getting user detail correcly but when we match with the password ( simple text ) it always failed and goes to else part and thus it gives 402.

here is my relevant code

client side AuthService

authService.login = function (credentials) {
        var deferred = $q.defer();
        $http({
            method: 'POST',
            url: baseUrl + '/api/login',
            data: credentials
        })
        .then( function (res) {
              $log.debug(res);
              deferred.resolve(res.data);
          }, function(error) {
            $log.debug(error);
            deferred.reject(error);
        });
        return deferred.promise;
    };

server side checking

module.exports.userLogin = function (req,res) {
    console.log('----------Login----------');
    if(req.method == 'POST') {
        User
        .findOne({un:req.body.username})
        .exec( (err, user) =>  {
            if(!user) {
                return res.status(404).send({"message" : "no user"});
            }
            else {
                console.log(user, req.body);
                if(user.pw === req.body.password) {
                    return res.status(200).json(user);
                } else {
                    //always failed
                    return res.status(402).send({"message": "invalid credentials"});
                }
            }
        });
    }
};

here is the response on terminal

mongoose connected to mongodb://localhost/loc8r
OPTIONS /api/login 200 4.553 ms - 4
----------Login----------
{ _id: 591ddbd91c343acac0114ab5,
  un: 'root',
  pw: 'pass',
  createdOn: 2017-05-19T18:01:58.729Z,
  gender: true } { username: 'root', password: 'pass' }
POST /api/login 402 35.329 ms - 33

do we need to use JSON.stringify or what?

via pro.mean