WIP for #4665 (improved password hashing)

This creates a new users_entity column and populates it whenever the password is available. Also deprecates setting salt/password attributes in favor of a setPassword() method that makes sure everything is done.

Thoughts on this direction?
Note: 255 is [recommended](http://php.net/manual/en/function.password-hash.php#refsect1-function.password-hash-description) to support future hash formats.