switched to pbkdf2 from bcrypt; fixed versions of deps
added patch to ranch to prevent a fail on the application stop