use real reset codes, improve random-password-generation