Add compatibility for PHP 5.6's `hash_equals` function

 - Updated `verify_password` to use new function
 - Tests to cover warnings and use cases.
I originally left out the `ord` diff as it is not UTF-8 safe and I wanted to stay future compatible.  But it doesn't matter as bcrypt, scrypt, PBKDF2, and SHA2x all generate ASCII safe hashes. Updated.