Replacing PHPass with password_compat

Replacing app usages of phpass with password_compat

Tidying up some loose ends. thanks @bantu

Fixing legacy password acceptance and tests

Adding user configurable cost to hashing