Upgrade auth_crypt to pbkdf2_sha512

* replace handrolled KDF by passlib (& usage of passlib API)
* replace md5crypt by pbkdf2(sha512)
  - handle upgrade from an old database (rehash on login)
* forward-port encrypt-at-install from f29ff5e