I'm confused by their claim of hashing and THEN salting authentication codes.

    On the server-side, we don't store the authentication
    code in plaintext. We hash it with PBKDF2 / SHA-256,
    salt it, then store it.