Note that the cost of bcrypt grows dramatically with number of stretches

* this will avoid people (like me) loosing an hour trying to understand
  why doing it "a little bit safer" with 20 stretches suddenly takes
  60 seconds to do sign_up or sign_in. An example of such discussion is:
  http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-talk/399627