My mail server was set up with `dovecot:ARGON2I` password encryption option. This allows people who set up argon2i as the encryption method to continue using it when users change their password with the plugin.
The [PHP `str_shuffle()`](http://php.net/manual/en/function.str-shuffle.php) documentation states:
```
This function does not generate cryptographically secure values, and should not be used for cryptographic purposes.
```
This change makes use of [`random_bytes()`](http://php.net/manual/en/function.random-bytes.php) if it's available and falls back to the old (probably ok) `str_shuffle()` implementation.
