Check hashed password matches expected bcrypt hash format before checking

We use Bcrypt.checkpw in the auth subsystem, but do a reasonably poor job of guaranteeing that the hashed password we send to it is really a hashed password, and checkpw does an even worse job of failing nicely. We should at least sanity check the hash complies with the expected format prior to validating.