the local plugin would go through bcrypt for every single call which
can be annoying at it makes things slower. By reducing the number of
rounds, we're making it quicker to use the local plugin.
Since a few weeks, every endpoint that relies on bcrypt are rate
limited so this shouldn't make things easier for an attacker to break in :)