actually generate and check secret picture/word passwords