new randomString function should take len arg
convert over to server-side crypto