use crypto random, refactor into JSON endpoint