mimic zope password generation

* disable hmac
* use 7-byte salt
reset user password from command-line
patch flask-security to simplify password checking