fix horrible security bug with pbkdf#2