Fix password validation.

Don't bind "password", "salt" or a bunch of other properties
received in request. Have a transient "clearTextPassword" field
for input and validation, crypt/salt in UserService.