You pass the hashed password to 'user_authenticate ()', while the function expects to clear the password (it will use hash indirectly when loading the account through 'user_load ()' ).
So, changing the declaration of the $ params array to
$params = array(
'name' => $user->name,
'pass' => $pass
);
should do your work example.
By the way, you could use it user_load()yourself so as not to directly query the database:
$user = user_load(array('mail' => $mail, 'pass' => trim($pass), 'status' => 1));
('status' => 1 - , , ;)