core, webadmin, restapi: Detach password from VdcUser

Currently when an user logs in we store the password of the user in an
instance of the VdcUser class and then we store that object in the
session. That has the inconvenient that assumes that all users have
passwords, and that is not always true, as some authentication
mechanisms don't use passwords for authentication. This change detaches
the password from the VdcUser class, storing it independently in the
session, so that it will be easier later to use other types of
authentication mechanisms.

Change-Id: I0ab9321816ee28355a4118910086891f5a552014
Signed-off-by: Juan Hernandez <juan.hernandez@redhat.com>