auth: add a check if the password leaked or not

[bkielbasa]

https://haveibeenpwned.com/Passwords

What we want to do is to use their API and check passwords when a user creates his account