Refactor and migrate profile managment

- Password and e-mail address changes require the current password.
 - Password and e-mail address changes require clicking a validation
   link in a confirmation e-mail (to the old address).
 - Name avatar files after the SHA1 checksum of the original to avoid
   duplicates.
 - Store avatar files in a subdirectory named after the first two hex
   characters of the file name.
 - Some refactoring of registration and login code

Account registration and validation now work with the new database
scheme and support a password encryption method deemed secure (using a
function backport from PHP 5.4).

Creating an account or changing core account information like the
password and contact e-mail address now create a change request entry
in a separate table to make unintended or malicious changes verifiable
and revertable by the account owner.
dev config: Move avatars to read-write medium