Why is this coffeescript code always returning true?

When I post to the server, regardless of the information I give the auth function, it returns true. My hunch is that I am trying to do something synchronously, that is asynchronous in nature, but I don't know how to fix it.

auth = (username, api_key, device) ->
  hashed_key = hash.sha256(username + api_key + device, salt) 
  winston.debug('Checking auth for ' + username)
  redis_client.get hashed_key, (err, data) ->
    if data == username
        true

# Main Handler for posting data for a device.
server.post "/:customer/:site/:device", create = (req, res, next) ->
    message = JSON.parse(req.body)
    winston.info(server.name + ': Recieved event from ' + req.params.device)
    authenticated = auth(message.username, message.api_key, message.device)
    winston.debug('****' + authenticated)
    if authenticated == true 
        winston.debug('Auth passed, got a valid user/device/api combination: ' + message.username)
        redis_client.publish('device_events', req.body)
        return next()
    else
        winston.debug('Auth failed, cant find device ' + message.device + ' for ' + message.username)
        return next(restify.NotAuthorizedError)

If you know (or have a hunch) that something is asynchronous, you should pass what to do afterward as a callback function. I'm not sure how your server's post function is working, though if it's like Node HTTP's request you should do something like the following:

get = (location, callback, retriever, filterer, formatter)->
  decoratedCallback = (data)->
    callback formatter.applyFormat filterer.applyFilter data
  retriever.retrieve location, decoratedCallback

module.exports = get