Make user password authentication fast again

Authenticating a user's password was very slow (~100ms!) because the
underlying bcrypt algorithm is -- intentionally -- very slow to deter
password cracking. Pavel found that this became a huge performance
problem for connections using basic auth instead of session cookies.

I fixed this by caching the results of successful bcrypt calls in memory
so subsequent authentication of the same username/password will be fast.
This doesn't weaken the bcrypt protection because failed logins are still
slow (to deter online attacks) and the cache is never persisted (to
deter offline attacks, i.e. an attacker stealing the database.)
Moreover, the in-memory cache only stores passwords as SHA-1 digests,
not cleartext, so passwords aren't lying around in RAM or swap files.

Also added a new unit test that makes sure user authentication takes
< 1ms after the first successful login.