fix BOTH bugs that lead to password errors around char 20 (in default charset)

I guess the commit message says it all.
First bug: range(num, 0, -1) does NOT include 0, so the reversed array is also truncated.
=> missing the last character of the first round of hashing
Second bug: 'data' was being appended to itself, so the 'key' argument to the hash function got longer and longer. 
=> yielding totally different results starting at the second round of hashing