Update default password hash to argon2, set default auth_token timeout to something sane

[jwag956]

This is what all the cool kids are using. bcrypt is still supported - but not recommended. auth_tokens defaults have always been 'no expiration' - that's crazy.

This needs to be on a major or minor release.