'hash-credentials & 'verify-credentials use pbkdf2

Fixes #31

Replace the simpler salted-hash approach with an actual PBKDF, to make
life harder for an intruder who manages to retrieve passwords.