Use Security::hash() instead of deprecated AuthComponent::password()