Update hashing algorithm for passwords to BCrypt

Previously hashes were computed as sha1(lower(username) . password), update this to add a layer of sha256 so that it becomes sha256(sha1(lower(username) . password) based on ideas by @jdarwood007.

The cookie password hash becomes sha256(password_hash . salt) instead of sha1(password_hash . salt), but the login hash remains same as before. This provides additional protection as someone with the hash from the database can't login directly simply by submitting that into the login form, they'd still need the original password to be able to login

EDIT: Updated this PR to move to entirely to bcrypt instead, and drop client side hashing. See commits for reasoning

Signed-off-by: Shitiz Garg <mail@dragooon.net>