[#1530] use passlib for passwords

This uses http://pythonhosted.org/passlib/index.html instead of https://www.dlitz.net/software/python-pbkdf2/ that was mentioned in the meeting notes. Passlib looks to be more maintained, the default salt length and default number of rounds is periodically increased by the authors, which does not seem to happen for python-pbkdf2. Passlib also does all the prefixing stuff for us. 

Also, in a few years time, the default number of rounds/salt length in passlib may have increased but old passwords hashes will still remain so there is some code to detect and upgrade passwords as users login.