Enable secure hashing by default, unless explicitly disabled.
Sessions are independent of passwords
Merge remote branch 'origin/feature-phpass' into integrate