I suspect that your plugin is running.
Try putting this at the top and check the error log in the Manager:
$modx->log->(modX::LOG_LEVEL_ERROR, "Plugin Executed");
Does your cURL call return '1' exactly when the user is valid? If so it would be safer to use === '1'.
For the end of your code, instead of the if statement, try this (note the underscore on _output):
$modx->event->_output = ! empty($output);
return '';
If it works, try changing it to this safer version:
$modx->event->_output = $output === '1';
return '';
You may have to do it this way:
$modx->event->_output = trim($output) === '1';
return '';