[swsieber]

Would it be an okay practice to prepend the username as extra salt, still using the randomly generated salt?

[Amorymeltzer]

Why not just use a longer salt? The username is only going to reduce randomness. Moreover, I don't buy the presumed advantage: nobody is really parsing that message to mean someone else could have the same password.

[marcosdumay]

Be careful about how you merge the username and the random salt.