Allow server to disable authentication schemes

_users documents might have credentials protected with earlier schemes (password_sha). Allow a CouchDB server to refuse to authenticate users using older schemes.

For bonus points, allow further config options to insist on a work factor threshold for schemes that support them (pbkdf2).