Storing hashed passwords
SHA256 is not a secure password hash because it is fast. See How to securely hash passwords? on security.se for details.
It's not obvious that random is good enough to generate salts. While the requirments for salts are lower than those for keys, you still need a decent RNG. I recommend using SystemRandom.