<i>But no, you can't re-hash with a new salt without access to the plain-text password. If you could, so could the bad guy :)</i><p>Yes you can, if you believe this: <a href="http://benlog.com/articles/2008/06/19/dont-hash-secrets/" rel="nofollow">http://benlog.com/articles/2008/06/19/dont-hash-secrets/</a>
This is exactly why HMAC is more complicated than just:<p><pre><code>    hash(message+secret)</code></pre>