docs/config: remove reference to auth:salt

It works, but is not supposed to be supported anymore :-)

Related to #150.
auth: change HashPassword so it uses bcrypt, always

Now both ChangePassword and CreateUser will hash the password using
bcrypt.

Closes #150.
auth: introduce the "auth:hash-cost" configuration variable

In smaller server, this value will be low, so the server can do other
things than calculate hashes :-)
api: define auth:hash-cost to minimum value in tests

Related to #150.