Passwords changed to pass_by_reference

Changed function definition for check_passwords callback to have
passwords passed by references. This now works with PHP 5.4, which
deprecated call-time pass by reference.