Explicitly list dependencies

Explicitly list our dependencies (all two of them) in the README and add a
script to pip them down. Not strictly necessary but makes my life easier when
I move to another machine with a different virtualenv :)
Answer login queries with a covering index

Creates a new index on auth_users that can answer login requests without
reading from the table. Minor optimization, but one that takes just a minute
to do and has few downsides, so might as well do it now.

Also makes username explicitly unique, since our login() funciton
assumes that fetchone() with a username will do the Right Thing.
Hash passwords with scrypt and cryptographically random salt

Changes the password hashing function we're using to scrypt, which is a more
CPU and memory-intensive hashing algorithm meant for use in password storage.
The previous implementation using SHA1 plus salts would be highly vulnerable
to GPU-based dictionary attacks since SHA1 is so easily parallelized on that
hardware. In general, a fast hashing algorithm puts more power in the hands of
attackers so we want to be slow.

I've chosen scrypt as our slow hashing algorithm because:
1. There's a reasonable python binding that's regularly updated from the
upstream library.
2. The library exposes some sane defaults for password hashing.
3. While the standard recommendations for hashing would be PBKDF2 using SHA-256
or bcrypt, scrypt offers stronger theoretical guarantees. For a more commercial
product, the shorter period of time that scrypt has been under the attention
of cryptographers and security auditors would be a concern, but I think a well
regarded novel approach to the problem should be fine for this.

While I was here I also updated the salt generation to use os.urandom so we get
good quality random numbers.

Details on scrypt are available here:
http://www.tarsnap.com/scrypt.html

Reasonable blog introductions to password storage are available here:
https://crackstation.net/hashing-security.htm
http://security.blogoverflow.com/2013/09/about-secure-password-hashing/
Fix obvious syntax error: semicolons are a thing
Merge pull request #33 from jculpon/users-index-cover

Answer login queries with an index
Merge pull request #32 from jculpon/scrypt

Hash passwords with scrypt