Btw., I also realized that the way I did the password hash upgrade here would totally introduce a security hole that would random people allow to choose an arbitrary new password if the existing password would be hashed with the old password scheme.