Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
@tom-- 

Well, strong encryption keys should not be derived through PBKDF2. Instead, you should offer 2 strategies. 

* "password": which will derive with `hash_pbkdf2` if present, or an internal implementation of PBKDF2 that you supply (via feature detection)

* "key": which will derive the necessary key using HKDF. This will use far fewer cycles, and not have the overhead (which is not needed for strong keys).

However, under **no** circumstances should you be using a custom derivation routine (even if it is similar to PBKDF2).