Why? Why not let a user always change his password even if it is just resalting it. Makes the code simpler and does not rely on the decoding the auth cookie