mention has_secure_password in README.

for many use cases, I think folks can probably get by with `has_secure_password` which you get for free in Rails. Let's let em know it's an option.