Improved password cryptography

Used password_hash if exists. If not, use sha1 (previous version).
Why don't we add `password_options` as a key to the `$config` array instead of adding another argument?