passwordless login + proper migrations

src/security.rs

@@ -37,12 +37,14 @@ pub struct RandomTokenGenerator;
 #[async_trait]
 impl TokenGenerator for RandomTokenGenerator {
     fn generate(&self) -> String {
-        new_secret()
+        hex::encode(new_secret())
     }
 }
 
-pub fn new_secret() -> String {
+/// Generates 32 cryptographically random bytes. Callers that need a
+/// client-facing string should hex-encode the result.
+pub fn new_secret() -> Vec<u8> {
     let mut bytes = [0_u8; 32];
     OsRng.fill_bytes(&mut bytes);
-    hex::encode(bytes)
+    bytes.to_vec()
 }