distillation of user/auth methods into User.pm

* User::_get_salt
    * ::valid_password
    * ::get_sha1_hash
    * ::get_pbkdf2_hash

* other refactoring in User/Sanity/Session to reduce code