Fix passphrase generation

Well, it's an idempotent endpoint, so I feel funny about using POST.