moved salt to user

see comments in gae-init/gae-init#201
not really as that line is just evaluated once on instance start, so it would be the same salt for all users of this instance, which is kind of bad still...

i also opted to not set salt as long as there's no password set... this has the nice effect that you can't rely on it being set by default and this automagically makes it backwards compatible ;)