title: Upgrade password hash from md5 to bcrypt
body: <p>Its been discussed here before, but there seems to be no conclusion.</p>
  
  <p>Ideally, don't want to maintain state (upgraded/not upgraded) in the database etc. so, here is what I'm thinking:</p>
  
  <p>bcrypt the MD5'd password, and use "username + something else" as a salt.</p>
  
  <ol>
  <li>Does this scheme make any sense? </li>
  <li>Also, in general is it a good idea to use the username as a part of the salt? I read somewhere that adding a different salt to each hash makes it more secure. Is that correct (especially in context of bcrypt)? </li>
  </ol>