moved salt to user

see comments in gae-init/gae-init#201
the at least you should do the `user.put()` in the `password_hash`