Heads up to anyone using the email-auth template, a significant bug was found and closed via PR, the salt wasn’t being used, only the

SALT_ROUNDS

constant. See https://github.com/graphcool/templates/pull/135/commits/94e94a553e04bb9dd83a143839bee88105fc72f3