Note that the cost of bcrypt grows dramatically with the number of stretches

* this will avoid people (like me) loosing an hour trying to understand
  why doing it "a little bit safer" with 20 stretches suddenly takes
  60 seconds to do sign_up or sign_in.