Security: Increase bcrypt salt cost factor, use externally configured cookie-salt if provided