Remove openid and add a login form
Remove User upsert - expose create directly. Capture password in create
Store password on registration in proper hash
Add tests to make sure a newly created user can login
Drop users.image_url