Allow native bcrypt for performance

/to @ritch 

See https://github.com/strongloop/loopback/issues/892
`bcrypt` is not a dependency of loopback AFAICT. Should it be listed as an `optionalDependency` in package.json?