Always try to migrate to new hashes. Only create legacy hashes if a
plugin sets password/salt directly (with deprecation warning).