moved salt to user

see comments in gae-init/gae-init#201
i had a `user.put()` in there before, but this just results in a double-put when you first set it in `main/profile()`.