user.password could be used by some other part of the applications that's expecting to find the password hash in user.password.

Actually.... is this line a noop?  you've just a conditional, not assigning the result to any variable.