Most organisations still store their passwords wrong. Here is what actually works.