Update User.php

Fixed incorrect salt generation.
When we pass $cost param lower than 10, returned salt would be invalid.