salted hash passwords

- new passwords (either for new users or people updating the password) are now stored with salted hashing (128 bytes salt / sha256)
- existing passwords are migrated when user signIn (only moment where the password is known clear by the server)
- maybe we should look for key stretching (bcrypt or pbkdf2)
use password_* for storing salted passwords

they are only available in php 5.5, but we use a userland compatible implementation in the meantime
Merge branch 'salted-passwords'