Improvements to password hashing, resistance to timing attacks, rehash if needed