Modernize password hashing

This gradually migrates users to modern hashes (into a new column) as they log in; deprecates setting the salt/password attributes in favor of a new setPassword() method (setting salt/password continues to work but will revert the user to the legacy MD5 hashing); and moves core password functionality to a PasswordService object.

I'd like to get this in 1.10, then we can later decide how to deal with forcing removal of the old hashes, how much control to give the site admin about this process, etc.

- [x] address comments
- [x] rebase, fix commit msg
- [x] fix build failure
- [ ] decide if this is an acceptable first step