Document digestPassword field for createUser/updateUser commands

digestPassword defaults to true, which means, somewhat counterintuitively, that the server is responsible for password hashing. If a client sets it to false, it indicates to the server that the caller has already hashed the password (by MD5-hashing <username>:mongo:<password>)