verify_password can use salt encoded w/ bcrypt password

Under opscode-account, users both newly created and with updated bcrypt
passwords have an empty string stored for salt, because the
bcrypt modular format for the hashed password also includes the
salt.

With this change, when the salt is empty, we will use the encoded
modular bcrypt format in its place - the bcrypt library will use
only the salt portion of the hashed password.