MappedPassword now uses bcrypt, but is backward compatible with existing passwords and schemas