prefer bcrypt if available