global: Use t_buffer_create sed -i -e 's/buffer_create_dynamic(pool_datastack_create(), */t_buffer_create(/g'

auth: global rounds parameter replaced with argument to password_generate() username and rounds parameter moved to a single password_generate_params structure.

auth: Use mem_equals_timing_safe() for all password hash comparisons. It's unlikely these could be used to perform timing attacks, since the attacker would have to have broken MD5/SHA badly enough to be able to quickly generate string that result in wanted hashes. Still, the extra cost is almost nothing and it's always better to be super paranoid!

Remove now-unnecessary direct stdlib.h #includes.

auth: More error checking and cleanups to SCRAM-SHA-1.

auth: Add and use SCRAM-SHA-1 password scheme