SHA-512 plaintext passwords before bcrypt

Avoids bcrypt limitation of only using the first 72 characters
of a password. Very counter-intuitive limitation for VCCS.
Document some todo's.

Commit some XXX comments todo after vacation, to not risk loosing them.
init