It's not the method that we'll be using when we go MD5, but it looks like a solution, yes.
(The lost password issue has been a major support & confusion problem - generating a new password every time the user forgets is a real, real pain. We will not be encrypting the password on disk, but it will be MD5ed in the cookie. .. and if you're worried about the member files being read, then you seriously need to look at the security on your server.)
