Hash passwords even when users don't exist.

Not hashing passwords when users don't exist means there is an
opportunity for timing attacks when people use blowfish or other
expensive hashing algorithms.
Merge pull request #1393 from markstory/constant-time-login

Hash passwords even when users don't exist.