Bring SRP in-tree.
Verify a user's password in the web interface.

At the same time, we introduce a new flow for forms.  Form validation
functions should now be promises that either resolve with some useful
piece of data, or reject with a FormValidationError which contains an
invalidFields object with the individual errors.