Switch password hash to PHPass "Portable Hash" (bcrypt).

- New column pass_ph in user/ticket/grant tables.
- Upgrade-on-login/usage for all three cases (after successful validation the
  cleartext is rehashed with the new hash).
- To keep complexity acceptable, passwords beyond 72 chars are no longer
  accepted even with the old hash.
- Fix username leak timing attacks along the way.
Remove completed items.
Avoid "errors already sent" messages after downloading a ticket.

Do not call session_start() after a sucecssful download anymore
(session_start() does not allow for a clean session "restart"). Luckily for us,
we don't really need to update session variables anymore.