Fixed statement about Security:hash's salt parameter

Just nitpicking, but it prepends the salt, not appends it:
https://github.com/cakephp/cakephp/blob/master/lib/Cake/Utility/Security.php#L120