use password_* for storing salted passwords

they are only available in php 5.5, but we use a userland compatible implementation in the meantime