#hardening

Password hash made four times slower in the same commit that stopped sign-in running it twice

The gateway's admin sign-in ran a deliberately slow password hash twice just to pick a label. The commit that cut it to once also raised the hash cost, and it never tested whether the new cost fit the runtime's memory cap.