Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
I don't entirely understand [PHP's documentation](http://in2.php.net/manual/en/function.password-hash.php) for `PASSWORD_DEFAULT`.

I think it says that `PASSWORD_DEFAULT` is – *at present* – the same as `PASSWORD_BCRYPT` in all versions of PHP >= 5.5.0 but that it may change in the future if PHP decided to adopt a stronger algorithm.

Can someone verify this for sure?