Exercise 3: What Happens to the Hash on First Successful Login — Possible Solution
====================================================================

WHAT HAPPENS
------------------------------
Per this chapter, the first time the admin successfully logs in, Django's own authenticate() function verifies the submitted password against the stored bcrypt hash using BCryptSHA256PasswordHasher - and then, as a well-known built-in Django behavior, silently re-hashes that same correctly-verified password using the FIRST hasher listed in PASSWORD_HASHERS (PBKDF2PasswordHasher, Django's own preferred one) and saves the newly re-hashed value back to the user's password field.

WHY THIS IS DESCRIBED AS A "QUIET PAYOFF"
------------------------------
Per this chapter, this happens with no admin action required and no visible step in the login process - the admin just logs in normally, unaware that anything beyond a normal login occurred. From that point forward, the stored hash is a modern, Django-native PBKDF2 hash rather than the original bcrypt one, even though nothing about the admin's actual password or login experience changed at all.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains that a successful login triggers Django's automatic re-hashing using the first-listed (preferred) hasher, and correctly identifies that this transition from bcrypt to PBKDF2 happens silently, with no visible action needed from the admin.