Switched from my hacked code to lithium's new post auth validation https://github.com/UnionOfRAD/lithium/blob/master/security/auth/adapter/Form.php#L109

config/bootstrap/auth.php

@@ -24,24 +24,11 @@ Auth::config(array(
 		//'scope'    => array('active' => 'true'), //The active field must be true otherwise they can't auth, though we need
 		//to eventually send them to a page that explains they are banned.
 		'session'  => array('options' => array('name' => 'default')),
-		'filters'  => array(
-			'password' => function($password)
-				{
-					return $password; //prevents li3 from hashing the password before hand.
-				},
-				function($data) {
-					if(isset($data['username']))
-					{
-						//Get the user from the database
-						$user = User::find('first', array('conditions' => array('username' => $data['username'])));
-						//Hash the submitted password with the stored salt.
-						$data['password'] = Password::hash($data['password'], $user->salt);
-					}
-					return $data;
-				}
-			)
+		'validators' => array(
+			'password' => function($form, $data) {
+				return password::check($form, $data);
+		})
 		)
-	)
 );
 
 $secret = "cake";

libraries/lithium

@@ -1 +1 @@
-Subproject commit 463e0743b7a1e01dba9e73f33c42609175dbcc52
+Subproject commit a8fd7e546b666c33b0738cfd5f0970aa7c840430