Password tweaks.

- Force passwords and hashes into a string on password_verify so that hhvm won’t throw exceptions.
- Don’t add the PhpPassword if php doesn’t support the functionality.