make sha1 explicit default for password hashing

only takes effect on django 1.5 as this django setting was only added in 1.4

fixes: http://manage.dimagi.com/default.asp?87398