Accept older blowfish hashes.

Both `2a` and `2x` are valid types of blowfish hashes, that while being
older should be accepted.
Fix an issue where custom Auth config would cause errors.

When the params key is omitted from the AuthComponent config a fatal
error would happen.
Merge pull request #3575 from cakephp/3.0-security-hash

3.0 - Accept older blowfish hashes.