Use PBKDF2 for user password hashing (2)

This pull request is a squashed version of tkmorris's work in #169 as well as a substantial review and refactoring commit hopefully resolving the remaining issues to get this merged. As this patchset changes highly critical authentication as well as database code please review and test carefully.

At this point I only did very rudimentary testing. Namely database creation, update from last version, PBKDF2 benchmark and iteration updates (with SuperUser only and no other users). I also verified that what ends up in the database matches the PBKDF2 hash returned by hashlib in python. This patch will require testing with actual real-life databases.
Drop 'const'?