Moved password hashing out of Mongoose middleware

Passwords are now hashed before the model is saved to the database. We'll use
the passwords when generating tokens for the user, and it makes no sense to
query the database for the password first.