Ok, because we also accept unicode characters, this breaks badly. This should be:
```pw << SecureRandom.random_bytes(1).gsub(/[^a-zA-Z0-9\-_]/, '')```

Alternatively, we can use SecureRandom.base64...