Unsalted SHA256 passwords are still a long way from being secure, but at least we're not storing plaintext anymore.