Reworking hashing to use PHP built in password_* functions

I'm not sure if this is something you'd want to do but thought it was worth raising..

Uses PHP 5.5 built in password hashing or password_compat implementation
for older PHP versions. Requires PHP 5.3.7, but bcrypt hashing is broken
before then anyway. (RFC for password_* fns: https://wiki.php.net/rfc/password_hash)

Also a couple of config changes:
* allows choosing algorithm in config
* and allow using PHP's default cost value in config by setting cost to FALSE

Also included some 3.3 fixes in 2a09f84