bcrypt passwords, including hack for fucking PHP