Hashing twice, on the client as well as on the server, won't introduce any security issues if the choice of algorithm is good, and it does further protect the users password from being harvested from passive MITM'd SSL like it is on some corporate networks. (Yes I know MITM means they could rewrite the client to steal passwords, but that's work) If I was designing a password auth scheme that highly prioritized user security, I would hash both client and server side.