auth: use bcrypt.MaxCost when auth:hash-cost is undefined