Switched from bcrypt to PBKDF2 for password hashing