WIP: remove 'plaintextPassword'.

'password' can always be either a string or an object (indicating that
it's been hashed already with
something). user.services.password.bcrypt.preHash stores the algorithm
that was used to hash the password before it was bcrypt'ed.

Adds a lot of complexity, might back this one out.