Switch password-hashing algorithm to bcrypt -- INCOMPATIBLE CHANGE

This invalidates all saved password hashes, so existing users won't be
able to log in until their passwords are reset via the admin API.

This change is necessary because the 'passwordhash' package we used to
use had some serious security issues. Unfortunately bcrypt uses a
different algorithm and produces different hashes for the same
passwords, so authentication against a previously-stored hash fails.
Fixes #150