No autogenerated passwords

Helps address #587. This PR doesn't remove all the password generation code, it just forces `passwordGenerated` to false wherever that's passed in to templates, and adjusts the child signup page to show the strength test. 

If we really decide we're done with auto-generated passwords after user testing, a bunch of code can be removed. If we think we might want it back, I can back out the force to false thing and toggle it on config or whatever.