Clarify: "Use bcrypt to hash the password (which was already hashed with SHA256 on the client) for storage in..."