mozilla/fxa-auth-server — pull request #403 by dannycoates (2013-12-10 21:39:32+00:00)
Title: lockdown passwordStretching parameters

Strictly validates the `passwordStretching` parameters to only allow:

```js
{
type: 'PBKDF2/scrypt/PBKDF2/v1',
PBKDF2_rounds_1: 20000,
scrypt_N: 65536,
scrypt_r: 8,
scrypt_p: 1,
PBKDF2_rounds_2: 20000
}
```

This should address the immediate concerns of #400 and #401 but the flexibility of these values remains to be defined.

@rfk @warner r?