OK, here's the two different ways I was thinking about making the authentication for the login thing to store the passwords securely.
The first is the following.
Client hashes password bcrypt(username.static_salt.password)(cost is 7)
this is mostly to make it harder for someone to get in trouble if they reuse passwords in other places/to make me feel better.
then they send it to the server. The server then hashes it with bcrypt again(cost is7) there is a per-user salt which is appened to the user's password and hashed together. Another static salt stored in the code(ie for bcrypt itself) is in there. And we have another salt stored on the server(ie no database).
The other one is to use srp6a except to use bcrypt(with the same cost as above) for H(). Which of these is more secure in the long run against an attacker once they get the database. the N is going to be 2048bits.
Also assume all of this is done over TLS/SSL. I'm personally leaning towards the first one, but I want to be sure before I commit to one or the other.