Overhaul for website security/authentication

- Password hashing with SHA-256 using PBKDF2_HMAC for key extension instead of single iteration MD5 (lol..)
- Better password recovery with randomly generated keys, instead of using Python's built in hash function (which is completely unsuitable for cryptographic use), by storing the keys in the database
- More to come (this is not yet finished)
I didn't really like Donut's versioned hashing, since I'm really not comfortable having MD5-hashed passwords sitting in the database, as most alums won't ever log back in to have it rehashed. There isn't a clear point at which we can finish a migration and safely remove the option to have MD5-hashed passwords in the database. Also, if we decide to upgrade again (switching algorithms is probably unnecessary any time in the near future, but it's plausible that we would want to increase the number of hash rounds), it could be messy trying to maintain multiple hashing versions at the same time. 

One way we could do it would be to set everyone's password hash to NULL. Then, if they try logging in, then we would flash a message indicating that they would need to reset the password and redirect them to the recovery page. This would also be accompanied with a mass email to all current rudds about the change.