First implementation of password and salt generation

dev-master ?

maybe `@dev` is better. or maybe we should tag a 0.1.0