Use explicit_bzero to clear sensitive buffers after use

[btrask]

In any case of a function that expects a sensitive buffer (password or key), we should probably accept a pointer to a mutable buffer and zero it before the function returns...?

Or alternately, just clear it at the top level after the call returns.

• Blog login interface
• API session creation (currently disabled)
• Session lookup