Make sure that we have the canonical user_id *before* calling
get_login_tuple_for_user_id.

Replace login_with_password with a method which just validates the password,
and have the caller call get_login_tuple_for_user_id. This brings the password
flow into line with the other flows, and will give us a place to register the
device_id if necessary.

The `store` in a handler is a generic DataStore, not just an events.StateStore.

Various purge_history fixes

Various auth.py fixes.

Feature: Add an /account/deactivate endpoint

Bug fix: expire invalid access tokens

Add requestToken endpoints

Ensure that the guest user is in the database when upgrading accounts

Feature: Purge local room history.

Add an admin option to shared secret registration (breaks backwards compat)

Follow up to adding password pepper