This implements the previously documented hashed password support. While implementing that, I noticed a security hole, which this commit also fixes..
- make sure a user is in the userdb before assuming they're logged on based on session info (allows deleting uerdb item and invalidating all sessions)