strip off secure* prefix from hostname
add support for returning password as a hash

support simplistic key stretching by allowing the caller to supply a
hash function to use with the option of salting the password with the
key.
add pbkdf2 option for password output hashing