Use scrypt to hash passwords instead of current insecure salting with SHA-1

Resolves issue #367 using the scrypt hash algorithm.  Old logins will fail to work until they have been reset.  It is recommended to properly remove all old hashes from the database after patching (`UPDATE users SET password_hash=''`).