[Feature] don't hash passwords with MD5 in DB #114

All newly set and resetted passwords will now be stored as
blowfish hashed string generated via crypt().

Refs: #114