use randomstring, dont need crypto