OK...I'll see if I can debug the ShaPasswordEncoder.

However, if you look at the logging output of my own DatabaseBootstrapPasswordEncoder, specifically:

2012-07-24 14:05:13,279 DatabaseBootstrapPasswordEncoder [INFO] Username:testuser Password:5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8

...you can see that I am not getting 'password' back as the result of a direct query on the database before the ShaPasswordEncoder ever gets called.

This seems wierd, doesn't it...?