OK...I'll see if I can debug the ShaPasswordEncoder.
However, if you look at the logging output of my own DatabaseBootstrapPasswordEncoder, specifically:
2012-07-24 14:05:13,279 DatabaseBootstrapPasswordEncoder [INFO] Username:testuser Password:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
...you can see that I am not getting 'password' back as the result of a direct query on the database before the ShaPasswordEncoder ever gets called.
This seems wierd, doesn't it...?