`saltPassword` sounds a little funny to me, and I think `hashedPassword` is a little long too for all the names of options/args that take a SHA256'ed password (sorry, I know I put that in the spec). Can we adjust the names as follows?

`saltPassword()` -> `hashPassword()`
`hashedPassword` -> `password` everywhere
`password` -> `plaintextPassword` in the couple places where the server actually expects an unhashed password

The idea being that we want to emphasize where a password is plaintext (an unusual case), and the naming will also make it clear that the SHA256'ed password is as good as a password for logging in to the server. (To avoid people reading the code and saying, "Oh, the password is hashed, I don't need to use SSL" or something like that.)