Better hashing with phpass

As requested in #1410, YOURLS should protect user passwords with something stronger than MD5. I recognize that plaintext passwords are stored in `config.php`, which poses a problem because that file is harder to update than a database table.

This branch adds some code that updates the password entries in config.php with hashed passwords. It also displays a prompt to users when plaintext passwords are present, and allows them to set a preference about whether plaintext passwords are [always | never] upgraded to hashes in the future.