Password improvements

[craigh]

Passwords and password management must be significantly improved.

http://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords

http://www.dev-metal.com/use-php-5-5-password-hashing-functions/

php 5.5 is required for php password functions, but Symfony has polyfill loaded for 5.4 so we can begin using anytime.

• update algorithm to scrypt or bcrypt
• figure out way to update all existing passwords
• allow admin to reset user password with temporary password being sent to user and force update on first login. (this was already implemented)
• provide simple method for global 'reset' of all passwords including notification of temporary passwords to users via email in the event of site breach.
• use native php (polyfill) where possible.
• increase standard required default length of user password to at least 8 (currently 5)
• Password configuration - allow the admin to select 'degrees' of password security:
  • require numbers yes|no
  • require symbols yes|no
  • require some capital and lowercase yes|no
  • php password_hash allows a 'cost' param (manual) - allow user to select a value
• of course Symfony has some security related features we should use where possible.
• implement outsourced password meter
  • ✅ https://github.com/ablanco/jquery.pwstrength.bootstrap
  • ❌ https://packagist.org/packages/kartik-v/strength-meter
• add password generator
• add option to enable compromised password validator

[craigh]

I have re-assigned this to milestone 3 because I feel it is very important to correct these issues for this release and not delay.