Server-side password salts and hashing

I read a bit more about how salting passwords should be done. Now I grab
a new salt from /dev/urandom (via CppCMS) for every generated password
and hash the password on the server as well as on the client. This way
during a man in the middle attack the attacker doesn't have the password
due to the Javascript hash (in case this user uses the same password on
multiple sites). If the attacker gets the passwords hashes from the
database, he has a bunch of different salts to look at, so he can't
easily use reverse lookup tables.

Good reference:
   https://crackstation.net/hashing-security.htm

Also, make the database, key files, and uploads directory only readable
by the owner during installation.