security(passwords): switches password hashing to password_hash()

This gradually migrates users to modern hashes as they log in. It also
deprecates setting the salt/password attributes in favor of a new
setPassword() method. Setting salt/password continues to work but will
revert the user to the legacy MD5 hashing.