Reduce random characters to 2

Significantly shorter URL’s; it’s still 4096 different possibilities
for each id, and a client could be blacklisted for accessing too many
invalid URL’s. Besides, we’re probably not dealing with that sensitive
data to try to make it impossible to find someone elses link.
Fix form action URL