generate random password if requested