move PasswordHash to webapp-api to use in PoddSesameRealm
Change predicates to use hash instead of oas:secret