Harden security

I changed SHA1 to SHA256 

Also on the API and controllers, I added a new view model class for users. This is just a projection of database objects, but it doesn't include the hashed passwords and the salts.