generates pass, write it to the db, send to browser, only if code is correct, and less than 80 seconds old, then ssh's to testhost