dial down bcrypt rounds to 12
get the realm name from the dnsdomainname, not an attribute
use base lib for passwords, simplify refs to parent_domain