added a (not very smart/good) password scoring function
switched from a simple SHA256-HMAC to PBKDF2 for chat key derivation from passwords
switched to using password.score instead of just checking a passphrase's length
when decoding a base64 chat key, now trying both standard and URL friendly encoding
reworked the chat creation & joining a little more