If you're not already, use Devise.

https://github.com/plataformatec/devise

It's ballin'. Bcrypt by default, too.

Devise has too many features that I don't really need. I followed Ryan Bates's advice - use nifty:authentication generator.

You can choose which features you use. For instance, I've never used the single sign on/access token functionality. The reset password, account lockouts, etc. are awesome.

Salting is unnecessary.