(fix) swaps bcrypt for bcrypt-nodejs (untrusted)