make the bcrypt code slightly more sane; fix bug due to unsafe strlens