Use PBKDF2 for user password hashing (2)

This pull request is a squashed version of tkmorris's work in #169 as well as a substantial review and refactoring commit hopefully resolving the remaining issues to get this merged. As this patchset changes highly critical authentication as well as database code please review and test carefully.

At this point I only did very rudimentary testing. Namely database creation, update from last version, PBKDF2 benchmark and iteration updates (with SuperUser only and no other users). I also verified that what ends up in the database matches the PBKDF2 hash returned by hashlib in python. This patch will require testing with actual real-life databases.
Use his real name instead?  I'm not a fan of having nicknames in the copyright lines or LICENSE file. (So I'm not a fan of having "Kissaki" or "snares" in there, instead of their real names either...)

See: http://comments.gmane.org/gmane.comp.gnu.gnuzilla/1222

Seems to be: Mauricio Arozi

@tkmorris Is that OK with you?

(Should be fixed for PBKDF2.h as well)