fixed free() bug in derivekey(), now the caller has to free it.