Add compatibility for PHP 5.6's `hash_equals` function

 - Updated `verify_password` to use new function
 - Tests to cover warnings and use cases.
I'm not sure the following block of code is equivalent to the xor + or loop e.g.

```
    for($i = 0; $i < $user_len && $i < $known_len; ++$i)
    {
        $diff |= ord($known_string[$i]) ^ ord($user_string[$i]);
    }
    return $diff === 0;
```
However, it *appears* to still resolve the side-channel. Just worth examining before merging, I suspect. :smile: