Use passlib instead of bcrypt for password hashing

The passlib package supports bcrypt if the bcrypt module is available,
but switch to using pbkdf2_sha256 by default instead.  After upgrading,
existing bcrypt password hashes will be replaced by pbkdf2_sha256 hashes
as users sign in.

Also add a "minimum password hash time" configuration setting, and auto-
calibrate the number of rounds to hash with the first time a password is
hashed.  If the system's hardware becomes significantly faster at some
point, this calibration would increase the number of rounds to use, and
existing hashes would again be replaced as users sign in.
Tweak /endsession and /changepassword operations slightly

endsession: no need to check if the user is anonymous; the operation
doesn't set the "accept_anonymous_user" flag, so won't be called at all.
Also, it was buggy; if it had been called with an anonymous user, it
would have returned None, which would have caused a crash.

changepassword: support specifying the user whose password to manipulate
using either a user id or a user name.  Also rename the argument to
"subject" (since "user_id" makes little sense for a user name) and make
it optional (defaulting to the signed in user.)
Add testing of the /changepassword operation