[#1530] use passlib for passwords

This uses http://pythonhosted.org/passlib/index.html instead of https://www.dlitz.net/software/python-pbkdf2/ that was mentioned in the meeting notes. Passlib looks to be more maintained, the default salt length and default number of rounds is periodically increased by the authors, which does not seem to happen for python-pbkdf2. Passlib also does all the prefixing stuff for us. 

Also, in a few years time, the default number of rounds/salt length in passlib may have increased but old passwords hashes will still remain so there is some code to detect and upgrade passwords as users login.
+1 -- I've used passlib in a number of places and never seen the need to do this. The whole point of PBKDF2 is that it's slow, so I don't know why we'd add additional deps just to make it faster.