Update class-phpass.php

Use Double HMAC validation with a random key to make timing attacks ineffective