Hash passwords with scrypt

Changes the password hashing function we're using to scrypt, which is a more CPU and memory-intensive hashing algorithm meant for use in password storage. Details and justification for why scrypt are available in 54e7296.

This changeset will invalidate all currently stored passwords; I think it's too early to bother writing the code to support migrating.