I'm worried also that this will be too brittle, especially as we are looking to eventually upgrade to the latest version of Django and the [development docs](https://docs.djangoproject.com/en/dev/topics/auth/passwords/) lead me to believe that the salt would always be 3rd and the hash the 4th item.
As is, if the system was configured to use an alternate algorithm (not PBKDF2) - this code would also drop through to the else block and I'm not sure that would work.