Then you either have: 1) A different salt each time, meaning the server must know your plaintext password to validate, or 2) The same salt every time, in which

Then you either have: 1) A different salt each time, meaning the server must know your plaintext password to validate, or 2) The same salt every time, in which case the hash is essentially the password since that's all the attacker has to pass to the server next time.