That issue is solved by simply having "hash(password+salt)" the thing the server has stored and is checking.

In other words you can combine salts + hashes + nonces to both eliminate the server's need to know the password and the possibility of a replay attack.