Use CAS for updating user prefs.
Make randstring take a length.
Authentication token management/checking.
Crappy way to get your auth token.