Raw length of salt should be 16

I think it is bad to require 17 bytes of entropy for the salt, when only 16 bytes are needed.
The underlying bcrypt function in crypt expects only 128 bits in the salt.