Don't use tokens as password

In order to avoid that tokens can be used as password for direct
authenticating against CouchDB's `/_session` endpoint, we now derive the
password from a combination of the token and a secret value that is
stored in the user document.

Also, we now prefix the field names for the secret and timestamp values
that we store in the user document with `couch_email_auth_` each (i.e.,
`couch_email_auth_secret`, `couch_email_auth_timestamp`).