Use php 5.6's upcoming hash_equals() function to compare hashes generated with crypt() if available
Also prevent timing attacks if hash_equals() does not exist