Remember Me, avoid rehashing stored password - php

Question

I have been working very hard to write the most (hopefully) state of the art log-in and remember me features of my script with security in mind.
After hours of testing and getting everything to work i have bumped into a problem with a simple but awkward solution. User logs in, if remember me is checked, cookie is created, when user comes back to website the initiate function checks for cookie, if cookie is present and matches the auth_key value in database, the function will pull user login info (email, password) and use the login function to log the user back on. Problem is that the code/tutorial i was using is designed for an un-encrypted database password (for example purpose i suppose) and the system is trying to "bcrypt hash" an already hashed password.
I can think of two dirty fixes, the dirtiest is to create a secondary login function that avoids hashing the password, the still dirty one is to add a parameter to login() that specifies if the password is hashed or not and the script can "if" it accordingly.
Is there a better way?
public function login($email, $password, $remember = false) {
global $bcrypt; // Again make get the bcrypt variable, which is defined in init.php, which is included in login.php where this function is called
$query = $this->db->prepare("SELECT password, id, email, username, accountlevel FROM users WHERE email = ?");
$query->bindValue(1, $email);
try{
$query->execute();
$data = $query->fetch();
$stored_password = $data['password']; // stored hashed password
$id = $data['id']; // id of the user to be returned if the password is verified, below.
$email = $data['email']; //Stored User email.
$username = $data{'username'}; //Username.
$accountlevel = $data['accountlevel'];
if($bcrypt->verify($password, $stored_password) === true){ // using the verify method to compare the password with the stored hashed password.
// Check if user wants account to be saved in cookie
if($remember)
{
// Generate new auth key for each log in (so old auth key can not be used multiple times in case of cookie hijacking).
$cookie_auth = $bcrypt->randString(10) . $email;
$auth_key = $bcrypt->genHash($cookie_auth);;
$auth_query = $this->db->prepare("UPDATE users SET auth_key = ? WHERE id = ?");
$auth_query->bindValue(1, $auth_key);
$auth_query->bindValue(2, $id);
try{
$auth_query->execute();
setcookie("auth_key", $auth_key, time() + 60 * 60 * 24 * 7, "/", "touringlegends.com", false, true);
}catch(PDOException $e){
die($e->getMessage());
}
}
session_regenerate_id(true);
$session_id = $id;
$session_username = $username;
$session_level = $accountlevel;
$_SESSION['user_id'] = $session_id;
$_SESSION['user_level'] = $session_level;
$_SESSION['user_name'] = $session_username;
$_SESSION['user_lastactive'] = time();
return true; // returning true.
}else{
return false;
}
}catch(PDOException $e){
die($e->getMessage());
}
}
public function initiate()
{
global $general;
$logged_in = false;
if(isset($_SESSION['user_name']))
{
$logged_in = true;
}
// Check that cookie is set
if(isset($_COOKIE['auth_key']))
{
$auth_key = $general->safe_var($_COOKIE['auth_key']);
if($logged_in === false)
{
// Select user from database where auth key matches (auth keys are unique)
$auth_key_query = $this->db->prepare("SELECT username, password FROM users WHERE auth_key = ? LIMIT 1");
$auth_key_query->bindValue(1, $auth_key);
try{
$auth_key_query->execute();
$data = $auth_key_query->fetch();
if($auth_key_query === false)
{
// If auth key does not belong to a user delete the cookie
setcookie("auth_key", "", time() - 3600);
}
else
{
// Go ahead and log in
$this->login($data['username'], $data['password'], true);
}
}catch(PDOException $e){
die($e->getMessage());
}
}
else
{
setcookie("auth_key", "", time() - 3600);
}
}
}