#bcrypt

Fresh PINs for every account landed in a CSV during user import, so I threw them out

The first cut of my scheduler's user import minted a plain-text PIN for everyone. Later that day it copied the old app's bcrypt hashes across instead, so people keep the passwords they already know, and a few gaps are still open.