moved salt to user

see comments in gae-init/gae-init#201
this would auto-set the salt for users who haven't set a pw before but for example someone tries to login with their email...