Don't run invalid test password in series

We're not waiting for any particular result, neither can this result in
a race condition.
Add `LamassuConfig#updatePassword`

Rename `saveUser` to `addUser`.
Refactor our a `hash` function.
Use `hash` function for checking authorization too
Return whole user object as authentication result
Make salt 8 bytes, binary-encoded
Fix naming
Fix double `toString`
Pick new parameters for pbkdf2

256000 iterations makes computation take around 1 second on a standard
DO droplet.
Merge pull request #8 from lamassu/users

Users