Use bcrypt for password storage

This patch should change password setting to use bcrypt, and password checking to first check md5 (converting to bcrypt if found) and then check bcrypt.

Pretty sure that sessions should remain valid during the transition -- session IDs have the password hash as part of their input, but as long as a user doesn't change their password, the md5 session remains valid; and when they do change their password, they get a new session ID anyway.