fixes on create user and sessions settings -- WIP

note, modified the password lib to exclude some confusing characters.  also default generation format uses number and uppercase letters, but is only 6 chars... kind of a personal preference since I don't think "memorable" is any more memorable and just easier to attack and more characters to type, and having a password that is hard to remember prompts you to write it down, which we want.  anyway something we can easily pull into a config later.