Fix some bugs related to changing from secret to secretHash

In most circumstances now, PoddUser.getSecret will be null, with the
main exception being on the client where it needs to be sent in using
oas:secret
Populate existing hash for change password operations
work on migrating tests away from digest to cookie