add PasswordUtil facade for password hashing; reduce bcrypt log2 rounds

All of the sites were BCrypt methods were being called
have been replaced by calls to PasswordUtil methods.
BCrypt has been made package-protected (to avoid direct calls.)

Reducing the bcrypt log2 hash rounds from 12 to 10 (where 10
is the default) significantly reduces CPU load on login.