typo fix
refactor of password hashing library:
* make it more obvious what's going on
* control use of bcrypt & auto-promotion via config
* die if bcrypt or hashing secret is missing (and is needed)
* fixed and tested auto-promotion