Update lib/password.php

Change the requirement for `$2y` to be `$2a` when set with the `define('PASSWORD_COMPAT_2A', true)` flag is set. The backported fix in the Debian 5.3.3+squeeze14 package does not introduce the new `$2y` prefix, however it *does* correct the bug under the existing prefix which makes the use of `2a` acceptable.