Update security policy:

- deletion is now implemented
- update phrasing about password storage to reflect use of bcrypt
- access tokens are now stored encrypted

@coryvirok