mt_rand() is not secure from a cryptographic point of view, let's use openssl_random_pseudo_bytes() here

do not create a db if already existing .. and reset the user password instead of creating if the user already exists