Since this package uses bcrypt < v2.0.0, whihch is susceptible to bcrypt wrap-around bug, we need to upgrade.