Wait for the promise to resolve before using the sodium object. Bug discovered not during local testing but on deployment server.

Note: this applies also to the security spike on which the code here is based.