updated bcrypt to non-leaking global fork