Keep User secrets out of active memory

[DavidRieman]

Right now while we have a User logged into an active session, the User object is fully in memory. This currently includes their Salt and HashedPassword. However, we have to assume that at some point a malicious actor on the server may find some way to dig into the objects held in memory, and thus retrieve these properties from online session User objects. (From there it's probably trivial to brute force the passwords offline without raising any suspicion from failed login attempts.) We should see if we can reduce this additional attack surface. One way that should help would be to move authentication-related data out to its own entries in the DB, then, only when auth is successful is the resulting User object loaded, and that won't pin the Salt or HashedPassword around in memory anymore.

(Note this impacts how PW Change #43 should get fixed.)