index: use pbkdf2-compat instead of cryptojs

As simple as it sounds, uses `pbkdf2` directly.

On the plus side, the tests now only take <1 second.
On the down side, we'll have to wait for https://github.com/dominictarr/sha.js/pull/8 to be merged and then consequently pushed upstream to `crypto-browserify` before this can be used in the browser.