Rely on checking for PASSWORD_DEFAULT, which should ALWAYS be available.

Since this is supposed to be forward compatible.  What happens if BCRYPT is pulled one day for any reason?  This would break forward compatibility, but relying on PASSWORD_DEFAULT should be safe.

I think another option would be:

if ( ! function_exists('password_hash') ) {
}
Merge pull request #26 from johncongdon/master

Fix for potential forward compatibility break.