Implemented bcrypt and pbkdf2 -- even if PHP doesn't support them natively.
Also wrote a unit test for testing the password hashing code. (PHPUnit ftw)

Our solution to stopping timing attacks is a double-HMAC with a random nonce,
in case the native solutions don't work.

Defaults to PBKDF2 for now -- will add an scrypt binding later.