Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
I take my my request. I ran some tests and found that the PHP loop implementation is much faster than I imagined. It's something like 30% slower than `hash_pbkdf2()`. [Test code here](https://gist.github.com/tom--/6d75d76cd46740d6831a)

There are discrepancies with the IETF test vectors that I will report in an issue.