Issue title: Security issue : use hash_equals() instead of '===' to compare password hashes
 Issue body: Dear dev,

First of all, thanks for this library. It is really good.

I would like to point out a security issue in the BCrypt class : 
```php
  public function verify($input, $existingHash) {
    $hash = crypt($input, $existingHash);
    return $hash === $existingHash;
  }
```
A simple strict equals sign `===` is used for hash comparison, which is vulnerable to timing attack.

The `hash_equals()` function should be used (http://php.net/manual/en/function.hash-equals.php) for comparing hashes (as recommended in http://php.net/manual/en/function.crypt.php).

This function is available for PHP >= 5.6. For older PHP version, there are a lot of functions in the comments of the `hash_equals()` function.

Regards
 Comments: 
 Comment 0: It's ok. I think that by using “===” and “!==”  instead of "==" and “!=”   , respectively , prevent PHP from attempting to guess the variable type (float vs string). Also , as far as I know,  the hashed value should start with 0e and the subsequent characters to be digits. Only then can  be  parsed as floats and get converted to 0.0. But I m not sure.
 Comment 1: I think you misunderstood my post.
I am **not** discussing the use of comparison `==` vs. identity `===` operators.
The identity `===` operator is _almost_ always a better and safer choice.

However, in the case of hash comparison, in PHP, a specific `hash_equals()` function is specially provided to perform a secure comparison.

More information on this SO answer, with some references: https://stackoverflow.com/a/23959696
And of course, the PHP man page: http://php.net/manual/fr/function.hash-equals.php

Btw, a hash value doesn't necessarily start by "0e". But it can indeed start with a number (and can also consist in only a suite of numbers) which would be interpreted as an something different than string by PHP type coercion. 
 Comment 2: @Indigo744 Sorry, about  "Also....he hashed value should start with 0e and the subsequent characters to be digits.." .It was my bad English and me being sleepy. Of course hashed passwords can start with a variety of chars. I wanted to say that  for timing attack to have a chance the hashed value should start with something like  ^0+ed*$ , which in PHP equates to zero when magic typing using the “==” operator is applied, thus it can be treated by PHP as a zero ( integer 0 ).

Play with the following and change the == to === . Also change the first 2 chars in the second comparison e.g from 0e462097431906509019562988736854  to $1462097431906509019562988736854 and run the code again 
`
<?php 
 if (hash('md5','240610708',false) === '0') 
{
  //will output not matched with === and will output matched with ==
  print "Matched.n";

}
else { print "Not matched"; }

/** Here we still keep == but if you change the hash
  * string to something that has not 0e as the first digits or the 
  * subsequent characters numbers there won't 
  * be a match to zero.
  * e.g try $1462097431906509019562988736854 or 0eA62097431906509019562988736854
  */

if ('0e462097431906509019562988736854' == '0') 
{
 
  print "Matched.n";

}
else { print "Not matched"; }

// Current PHP version: 5.5.9-1ubuntu4.21

?> `

But again, I m not a specialist. May be better we should use hash_equals() for timing attack safe string comparison, password_hash()  to create a password hash -  it's compatible with crypt() -   and password_verify() to verify  that a password matches a hash. Regards
 Comment 3: @Indigo744 your concerns seem valid. Would you like to attempt a PR or would you prefer I submit a PR?
 Comment 4: @benedmunds I can try. What is the minimum PHP version you want to support?
CI2 minimum PHP version is 5.1.2 (https://www.codeigniter.com/userguide2/general/requirements.html)
CI3 minimum PHP version is 5.3.7 (https://www.codeigniter.com/user_guide/general/requirements.html)
 Comment 5: I just saw that CI3 offers a `hash_equals()` function in the compatibility module (https://www.codeigniter.com/user_guide/general/compatibility_functions.html?highlight=hash_equals#hash_equals). 
So if you want to keep supporting CI2 with PHP < 5.6, we should import this polyfill into the library.
{'source': 'GithubIssues', 'repo_name_with_owner': 'benedmunds/CodeIgniter-Ion-Auth', 'issue_id': 234489306, 'repo_stars': 2584.0}