having a random string is good for cookies evidently
tweak user show route