Replace HASHED_PASSWORDS with a per-user authentication_method that defaults DEFAULT_AUTHENTICATION_METHOD