lib-mail: Make sure mail_user_hash() won't return 0 as the hash. It doesn't seem to actually happen, but this makes sure of it.
lib: API change - var_expand*() now returns error string. This allows callers to fail properly if the format string is invalid.
Added director_username_hash setting to specify what part of the username is hashed. The default is "%u" meaning the full username. Another potentially useful value is "%d" for hashing only the domain (i.e. redirect users from the same domain always to same server so they can safely access each others' shared mailboxes).