Make the bcrypt call more expensive, let's stick to password_hash default of 10