Use best practice bcrypt password hashing function

In place of general purpose sha256 hash

http://codahale.com/how-to-safely-store-a-password/

Haven't been too careful with a migration, as we only have ~3 users