User: password hashing and checking improvements
User: password hashing and checking improvements

Not allowing the clear text check, don’t like the security
implications; always use random() to generate the salt and let it do
its best to be secure; using hash_equals() if available to check
passwords, to avoid timing attacks.

xenocrat/chyrp-lite,xenocrat/chyrp-lite