changed one use of BCrypt to PasswordUtil

Missed this in the earlier commit that added PasswordUtil.
another load testing experiment (more builders)

Handled 351 concurrent users quite easily, although it took
3x 8-core builders!