Merge pull request #1497 from slingamn/bcrypt_cost

reduce recommended bcrypt cost to the lowest allowed value

default.yaml

             max-attempts: 30
 
         # this is the bcrypt cost we'll use for account passwords
-        bcrypt-cost: 9
+        # (note that 4 is the lowest value allowed by the bcrypt library)
+        bcrypt-cost: 4
 
         # length of time a user has to verify their account before it can be re-registered
         verify-timeout: "32h"

traditional.yaml

             max-attempts: 30
 
         # this is the bcrypt cost we'll use for account passwords
-        bcrypt-cost: 9
+        # (note that 4 is the lowest value allowed by the bcrypt library)
+        bcrypt-cost: 4
 
         # length of time a user has to verify their account before it can be re-registered
         verify-timeout: "32h"