use php 5.5's password_hash, salt must now be greater than 21 chars