Encrypt raw password, not HMAC of password.

[longhotsummer]

This passes passwords directly to passlib's CryptContext
methods and relies on it to do the hard work.

For backwards compatibility we fall back to trying the old HMAC approach
when verifying passwords, but only if a salt has been set. Legacy passwords
are updated upon check.

Previously, we passed the HMAC'd password to passlib, which meant that
we weren't compatible with other users of passlib (such as Django) or
the Modular Crypt Format at
https://pythonhosted.org/passlib/modular_crypt_format.html

Fixes #320

[longhotsummer]

I'd like to get feedback on this before going through and updating the docs.

[coveralls]

Coverage decreased (-0.14%) to 94.72% when pulling 273cac0 on longhotsummer:no-hmac into c7d0ea9 on mattupstate:develop.

[coveralls]

Coverage decreased (-0.14%) to 94.72% when pulling 273cac0 on longhotsummer:no-hmac into c7d0ea9 on mattupstate:develop.

[coveralls]

Coverage decreased (-0.14%) to 94.72% when pulling 50b17fb on longhotsummer:no-hmac into c7d0ea9 on mattupstate:develop.