Allow User.hashPassword/validatePassword to be overridden

/to @ritch @bajtos 

The PR allows User.hashPassword and validatePassword methods to be overridden. It can be used as a workaround to https://github.com/strongloop/loopback/issues/251.