security: do not accept the MD5 hash of a password

Right now it is possible to enter the MD5 hash of e.g. a profile password instead of the actual password in the password dialog and the password will be accepted. That is a huge security hole. I guess it was there for backwards compatibility when we used to store profile passwords in plain text (a long time ago).

Follow up of #5455 where I first mentioned this.