Update class-phpass.php

Use Double HMAC validation with a random key to make timing attacks ineffective
Merge branch 'patch-2' into patch-1