actually pepper the token the server returns
fallback to randomness if config file is empty

also warn myself
add random data to the salt