#9 fixed password generation, added user token