add javadoc comments
set PasswordUtil.LOG2_ROUNDS to 8; successful load test with 700 users

Setting the bcrypt log2 rounds to 8 seems to keep the
CPU overhead of password hashing to a reasonable level.