Use PBKDF2 for user password hashing

I strongly suggest to at least salt all sha1 hashes if anyone else still wants to keep using that. To use sha1 for passwords is already problem enough, to use it without salting it is just wrong.

No need to explain why PBKDF2/scrypt/etc key derivation is better than just plain old hashing, right? Also, as answered on IRC I didn't touch any db structure creation code.