Implementing password_hash() according to RFC