Use/include an additional evern more secure password hashing algorithm in core

A follow-up to #723802: convert to sha-256 and hmac from md5 and sha1. We should consider adding to core the use or option to use even more robust (non-md5) hashing algorithm if available in PHP.