avoid using unhashed password in acid-state events

acid-state may record event parameters in the journal - this can
result in unhashed passwords being written to disk.

Refactor the library so that only hashed passwords touch acid-state.
implement deleteCredentials function