Make password hashing async.

This is going to become an arse when we add more ACL, will need to use something like async package

Closes #20