Comment by sevensevennine

Absolutely right-- the warning is only necessary if they're not hashing the password before templating the string prior to storage.