Check the SHA-256 password first, MD-5 second.

Since SHA-256 will be the default password encoding, it's better
to check it before MD-5.