Hash passwords even when users don't exist.

Not hashing passwords when users don't exist means there is an opportunity for timing attacks when people use blowfish or other expensive hashing algorithms.