mostly mdotson's additions to auth, with genPasswordToken