I don't hate the idea of putting this piece:

    base64_encode(hash('sha384', $password, true))

In client side JavaScript. I've seen my own passwords scroll in front of my eyes when debugging servers and reading POST variables. It's a minor level of shoulder surf protection before it hits the proper hash on the server.