Security : use php 5.5 password_hash instead of md5 to store passwords; fixes #487