add missing var statement to avoid global leak on "lr" in bCrypt.js