Use set_password() instead of setting the salt and hash directly.
Use more efficient is_valid_login() method.
Docstrings for set_password and a note for is_valid_login()