Improve hashing algorithm

[karllhughes]

Sha1 is no longer considered secure. Any interest in me trying to upgrade to PHP 5.5+'s native password hashing functions?

Two things that will be challenging here:

1. I think we can make it a non-breaking change by supporting some kind of password upgrade function.
2. It will require PHP 5.5 unless we want to write a polyfill that works for older versions.

I know some people are stuck on old versions, but PHP 5.5 and lower are all technically end of life, so it might make sense to stop supporting older versions at some point in the interest of making this project more secure.