This fixes some crypto sins to be *closer* to best practices

There are a variety of crypto sins that this project is committing that makes its security suspect at best.

This fixes:
* Replaces random.sample() with os.urandom output (which is much closer to being legitimately random) for password generation
* Increases rounds of hash_text() to 8192
* Make _get_padded_key() use PBKDF1 key derivation
* Actually use a nonce for encryption/decryption

Note: no attempts have been made to preserve existing data stored.