Comments by Jaepetto (Top 1 by date)

Adding the username into the hash is a good point. However, it forces your user to re-type his password when he wants to change his username. That may not be a real pain but should be considered beforehand.