Make all hooks optional if used internally

[ekryski]

Most of the hooks already do this. These ones need to be updated:

• query with current user
• associate with current user
• hash password

[daffl]

It is possible for a user to overwrite params.provider so you run the risk of exposing unsecured methods to the outside world. Although unlikely we might want to investigate using Object.defineProperty so that it doesn't happen accidentally.

[ekryski]

Sure. Let's create another issue for that though because that touches all the hooks and I don't want to block shipping in this in order to prevent someone from possibly screwing up their hooks.