… of less than 8 characters but EVP_BytesToKey() expects more.

disallows salt strings longer than 8 characters to avoid false sense of security.

Signed-off-by: Yichun Zhang (agentzh) <agentzh@gmail.com>