drop bcrypt rounds back to 12, challengeKey -> challengeKeyResponse in verifyChallenge