core: take password generator out of UI