If you believe salt has to be kept secret, yeah, don't write your own auth.