We should upgrade their hash *after* they've authenticated and proved they got the password right. Won't this just save whatever password they tried and make it the users actual password?