diff --git a/src/wuttaweb/grids/base.py b/src/wuttaweb/grids/base.py
index 403c01a..76149f6 100644
--- a/src/wuttaweb/grids/base.py
+++ b/src/wuttaweb/grids/base.py
@@ -853,7 +853,7 @@ class Grid:  # pylint: disable=too-many-instance-attributes,too-many-public-meth
         """
         if tools and isinstance(tools, list):
             if not any(isinstance(t, (tuple, list)) for t in tools):
-                tools = [(self.app.make_uuid(), t) for t in tools]
+                tools = [(self.app.make_true_uuid().hex, t) for t in tools]
         self.tools = OrderedDict(tools or [])
 
     def add_tool(self, html, key=None):
@@ -869,7 +869,7 @@ class Grid:  # pylint: disable=too-many-instance-attributes,too-many-public-meth
         See also :meth:`set_tools()`.
         """
         if not key:
-            key = self.app.make_uuid()
+            key = self.app.make_true_uuid().hex
         self.tools[key] = html
 
     ##############################
diff --git a/src/wuttaweb/views/users.py b/src/wuttaweb/views/users.py
index fca830f..03f5db9 100644
--- a/src/wuttaweb/views/users.py
+++ b/src/wuttaweb/views/users.py
@@ -90,6 +90,7 @@ class UserView(MasterView):  # pylint: disable=abstract-method
 
         # never show these
         g.remove("person_uuid", "role_refs", "password")
+        g.remove_filter("password")
 
         # username
         g.set_link("username")