Please don't use hashes for this. Use bcrypt (http://en.wikipedia.org/wiki/Bcrypt). Hashes are designed to be easy to compute, bcrypt is adaptive in the sense that it can be made harder to compute over time, so it's a lot harder to brute force. It also adds a salt by default.
I know I'm being a bit pedantic here, but both bcrypt and SHA1 are cryptographic hash functions.
So please, do use hashes for this, just realize that some hashes will be far more secure (like bcrypt) than others (like SHA1 or, FSM-forbid, MD5).
#2 - Dates should be stored in UTC (make sure the server has the timezone correctly set), and display in the user's TZ or a reasonable default. The language will worry about DST. Don't let SQL touch it (in fact, you should probably store a UNIX timestamp - uint - instead of a datetime).
I would argue the above as "best practice" for storing that info. The douchebag is the developer who won't spend 5 minutes implementing either solution.