Mention setup.py develop --upgrade also in release notes.

This commit sponsored by Christoph Schumacher.  Thank you!
only check password if there is a store_hash
need to use .get('messages') to not get a keyerror
use new in-memory db for testing
skip openid test if python-openid isn't installed