I think something is broken with Galaxy.
Since 2017-05-27 (according to Galaxy logs) a deployed app always reports the following
Note: you are using a pure-JavaScript implementation of bcrypt.
While this implementation will work correctly, it is known to be
approximately three times slower than the native implementation.
In order to use the native implementation instead, run
meteor npm install --save bcrypt
in the root directory of your application.
My app is METEOR@1.4.4.2 and bcrypt@0.8.7 is part of package.json.