You're salting and hashing your user's passwords before storing them in your database, right?