Merge pull request #602 from alex/hkdf-docs

Be clear about HKDF's applicability for password storage