Use the new password hashing APIs in DataProtection.

/cc @HaoK
@pranavkm heads up that this change is also here, but is slightly different. I prefer to make it private as you have it in your PR.