auth: use securecookie.GenerateRandomKey to generate a password salt