set user passwd min length to 5, create random token only if it doesn't exist