Add user passwords to enable login directly to apidoc

 - passwords are hashed with bcrypt
 - record algorithm version along with password to
   allow future changes
 - each user can have at most one password, but passwords themselves are immutable in DB
 - passwords stored in a separate table: user_passwords