change to 16 bytes of random strings to base 36 for tokens
workaround 302 redirect in Chrome not loading css link