Fix #87: security helper converted into component and improved

Fix #87: security helper improvement

Migrated from #4052
Suggest: "Key derivation by iterating HMAC in a PHP loop."

I would like to find a reference to explain why we don't recommend it but haven't found one yet.