secure random is not necessary when generating a token for db reset