bcrypt had bugs before 5.3.7