don't use python's random for session IDs