Add password history feature

People should not be able to reuse their existing password. That means
that any password reset event (such as caused by heartbleed) is somewhat
meaningless if the same password can be recycled.

We allow the encrypted_password in old_passwords to be null, since when
we create a user, we don't create a password for them.

A CfE Admin will create a new Lender Admin by specifying first and last
names, and an email address where the confirmation link will be sent.
The password isn't set until the new Lender Admin follows the link to
complete the sign-up flow.

We could get around this by generating a random value for the password,
but that was a bigger change.