TBH I don’t think Discourse submitting a password over HTTPS is your largest security challenge at this moment.
Cute. I see your sha1 and I lower you md5 
https://news.ycombinator.com/item?id=32796841
I see why that pbkdf2 doesn’t really work to split it up… the problem is the first line:
U1 = PRF(Password, Salt + INT_32_BE(i))
U2 = PRF(Password, U1)
⋮
Uc = PRF(Password, Uc−1)
Any ideas for how to split it up, though? I guess I can just use the pure userland php library: pbkdf2/src/PBKDF2.php at master · Spomky-Labs/pbkdf2 · GitHub
I would recommend to Discourse to hash things with a salt (userId works) before sending the password over the wire. Why not? It doesn’t have to become incompatible with what you are storing in the database now. Simply do the first 100 iterations in Javascript, then subtract 10 from 64000. You have a custom implementation of it anyway (copied from rails) so you’d just send along an isHashed variable, and if it’s true, then do the “last” 64K-10 steps only.