Password hashing and API key stub

We don't have to merge this if it doesn't make sense. I was unclear about if we are or are not hashing password. If not this should work. Couldn't test ```core``` because there is bug #30 @psiemens