Modify to match PHC paper v0

While porting to JS I noticed two differences to the paper submitted to PHC. The first was the order of the inputs when generating r[0]. In the paper it is `H(v[0] || v[g^2 - 1]`, but the source was opposite `__Hash2(r + (c-1)*H_LEN, H_LEN, r, H_LEN, r);`.

The second was the tweak, the PHC paper doesn't mention the 0xFF as the first byte for line 1 of Algorithm 1 (page 20). I can see it was in the original paper.