use random password for server user instead of hard coded