Allow password validation against legacy non-HMAC encrypted passwords.

This is to address #320 where it's difficult to validate against an old password database that hasn't had the passwords HMAC'd before encrypting.