PROV-835 Added code to ensure gradual transition to pbkdf2 password encoding

The Legacy adapter is built such that if a user authenticates it first
checks the stored password hash against old-style md5 encoding. If that
matches (i.e. the user entered the right password) it updates the hash
to pbkdf2.

The new standard authentication backend (CaUsers) now throws a
meaningful Exception if it encounters an md5 hashed password.