add biff erb helper 'random_string' for unique password generation in manifests