mt_rand() is not secure from a cryptographic point of view, let's use openssl_random_pseudo_bytes() here

do not create a db if already existing .. and reset the user password instead of creating if the user already exists

a salt is generated during setup and used to salt the user password hases in the database backend

generate a random salt during installation and store it in the config.php. use it to salt the password hashing.

the ',last' breaks all other rewrite rules and is also not there in the committed .htaccess, so removing it. anybody know why it was there?