make sha1 explicit default for password hashing

only takes effect on django 1.5 as this django setting was only added in 1.4
Merge pull request #2253 from dimagi/sha1

make sha1 explicit default for password hashing