[wip][#1530] use passlib for passwords

Still Needs Tests, pushing this to ask a few questions.

This uses http://pythonhosted.org/passlib/index.html instead of https://www.dlitz.net/software/python-pbkdf2/ that was mentioned in the meeting notes. Passlib looks to be more maintained, the default salt length and default number of rounds is periodically increased by the authors, which does not seem to happen for python-pbkdf2. Passlib also does all the prefixing stuff for us. Are we happy to use passlib?

Also, in a few years time, the default number of rounds/salt length in passlib may have increased but old passwords hashes will still remain, do we want upgrade users passwords automatically on log on again or do something like leave a warning in debug mode. Or is this trying to be too clever?