moved salt to user

see comments in gae-init/gae-init#201
Could be `default=util.uuid()`