Change the way that passwords are handled.

I have renamed the `User.password` property to `passwordHash` and replaced the
GORM event handlers with a simple `setPassword()` method that encodes the
given password and stores it in `passwordHash`. The name change clarifies
exactly what is being persisted to the database, while removing the event
handlers eliminates some unintuitive behaviour around validation.
Sync ch13 with ch12.