Allow User.hashPassword/validatePassword to be overridden

See https://github.com/strongloop/loopback/issues/251