Overhaul for website security/authentication

- Password hashing with SHA-256 using PBKDF2_HMAC for key extension instead of single iteration MD5 (lol..)
- Better password recovery with randomly generated keys, instead of using Python's built in hash function (which is completely unsuitable for cryptographic use), by storing the keys in the database
- More to come (this is not yet finished)
nit: don't commit with this here