Added max length password and salt to test cases. Fixed serious bug, doing strlen on salt, vs using salt->length.  The static salt buffer is not memset (probably should be) in the get_salt, and thus, a salt record 'can' have extra crap after the salt.  Does not hurt anything AS LONG AS you only look at salt->length amount.  The recent patch to use pbkdf2_hmac_sha512.h file lost the usage of salt->length and instead used the strlen, which was bad busted.  Found when a shorter salt followed a longer salt in self tests.  Things started to fail unexpectedly, and were hard to track down as why they were failing.