I think the use of stored procedures is underrated. Create a stored procedure to verify the password and only grant permission for the web application-user to run this procedure, nothing more. No one but the database itself needs, or can ever access the hash-column this way. This way you still keep the application separate from the data. I would even argue that we need to get back to the time where there was a DBA handling the data. The dev-ops thinking of mixing application logic and data has introduced a lot of unnecessary security issues.