Add simple hdo::users module. Closes holderdeord/hdo-site#414.

Admin users still need to have their passwords set manually
to be able to do something useful.