fix bug in SCRAM-SHA1's salted password calculations