I think stcredzero is concerned about the plaintext password passing through the pipes.

In this case, unique salts and hashes are used to simply protect the database; when the data is stolen, a rainbow attack will not effectively work.

Hashing those passwords also protects the user who uses the same email/id/password everywhere; if your db is compromised, you don't also compromise the user's identity (e-mail accounts, banking, etc).

It depends on the app, but I also think sending salts to the client and doing some md5/javascript in the browser is generally overkill.