Replying to all the comments about password generation and tests thereof:

The implementation I had was based on https://github.com/edx/edx-platform/blob/38e55a4eb93716f4671227326477f13c95f3e446/common/djangoapps/external_auth/views.py#L85, the only major difference being injecting a seed rather than using SystemRandom.

Reasoning:

1) I wanted something that was sure to work;
1) I wanted to pick a known-approved implementation to avoid relitigating it;
2) I wanted determinism in the tests.

I agree that injecting the seed was a mistake because it causes a global side-effect. Changed implementation to take a choice function instead, defaulting to random.SystemRandom().choice. This allows injection and removes nondeterminism in tests.