create-random-string revisited