Hash and salt the password on the client side.

This is just to prevent the 'I use the same password everywhere'
problem.