password generated on user approval