Added notes to the first connection design.
Properly use bcrypt:

- Don't crypto: use a library provided time-independent comparison.

- Document details about max password length and other caveats.
Fix Lintian error: unsafe symlinks exist only while testing.

We only need these actions during test time, so create symlinks to
them before running the tests and remove them after testing:

- actions/echo: /bin/echo

- actions/id: /usr/bin/id