Use bcrypt for login form. Add tests to check that salts and hashes are random, and check handling of invalid passwords or salts.
update model
Use bcrypt to hash passwords for new users in firstboot and user_add forms. Removed references to md5 hashing which was already non-functional.
Add add_user function to auth module.
Update tests for auth module, and fix some bugs discovered in auth module.
Fix check for already existing username in add_user. Add documentation of process for storing and validating hashed passwords.
Modify firstboot and user_add forms to use add_user function.
Use POST instead of GET for forms. It seems like it's working now.
Remove time.clock line in auth module. It wasn't being used.
No need to have avoid timing side-channel attack in user_add. We're just going to tell you if the user already exists anyway.
Made security.mdwn a little more explicit wrt bcrypt.