First attempt at encrypted master keys

Support storing the master key as a passphrase protected
ciphertext (AES in CTR mode with a random IV).
Adds an optional password parameter to init, newacc, and newms.