Unsure of the security of makeIdentHash / makePassword
Hey there! I'm unsure about makeIdentHash, which is defined like this:

```
proc makeIdentHash*(user, password: string, epoch: int64,
                    secret: string): string =
  ## Creates a hash verifying the identity of a user. Used for password reset
  ## links and email activation links.
  ## The ``epoch`` determines the creation time of this hash, it will be checked
  ## during verification to ensure the hash hasn't expired.
  ## The ``secret`` is the 'salt' field in the ``person`` table.
  result = hmac_sha256(secret, user & password & $epoch).toHex()
```

Since `secret` is signed therefore assumedly public, and so is username. You can probably guess the approximate epoch, which gives a pretty small keyspace for guessing `password & epoch`, subtract the epoch and you have the password. `makeIdentHash` is essentially being used as a password hashing algorithm.

While I'm here I'd ask you to reconsider the `makePassword` algorithm, which, strangely seems to use *both* MD5 *and* bcrypt. Generally speaking this does *not* have the effect you are expecting, because using MD5 and then bcrypt pins the ultimate keyspace for preimage attacks down to MD5's level. Think about if you used the world's best retina eye scanner but instead of feeding it actual retinas, you fed it really blurry photos of eyes. That's essentially what's happening there.