And there's a reason why high-level libraries like bcrypt handle salt generation and storage internally: if they didn't, people would screw it up. It's amazing how many people blithely use some crazy scheme like

    pwhash = md5("this is my salt" + password)

Progress in password hashing security is primarily progress in making things trivially foolproof and then hectoring people into using them.