I would log a warning if they're not using bcrypt to reinforce that that's what should be used. I don't want anyone to see this code and think using SHA-256 is OK b/c it's listed here, when we really just support it for backwards compatibility.