Store passwords in USER.PW as either cleartext (as is done in legacy) or as
the SHA1 hash of the password.  When changing a password or adding a new user,
always use the SHA1 hash password.