Fixes after review

[marcosh]

@gdeest this PR contains the fixes for the things we discussed during the lat review.

It' probably easier to review it commit by commit more than file by file.

The only thing I left out is moving the password encryption to the database level. This is motivated by two reasons:

• the current approach is a little safer, since passwords are encrypted earlier and reach the database already encrypted
• Rel8 would require to use the same type for plain-text and encrypted passwords, and this is something I'd like to avoid