title: Is it safer to double hash passwords with salt? (a little more complicated)
body: <p>In this case one wants to authenticate a user via http/s.</p>
  
  <p>In the registration progress the server generates a salt. This salt is send to the user. He then procedes to hash his password with the salt via js and send it to the server. 
  There the hash get salted again with the same salt and the twice hashed and salted password gets written into a db with the cleartext salt. </p>
  
  <p>If one tries to authenticate he sends his username, gets the salt and hashes the password. This is send to the server who hash it again and if the saved hash and this is the same the user is authenticated.</p>
  
  <p>I was wondering because of the recent heartbleed bug it would be nice to never expose the real password. But I've read that double hashing can increase the risk of collissions.</p>
  
  <p>Is the way I imagined that the safest way or do I get soimething wrong?</p>