Fix a security issue.

Doh.

We want as much entropy as possible: using the previous algorithm, if domain
name is only one character long, we only xor the first character of the user
secret, and toss all the other user provided entropy out the window. Now we
just use simple string concatenation. This is much simpler to understand, and
also much more secure.