ensure Rack::Protection::Base#random_string always outputs 32 characters

Prior to this commit, authenticity tokens would be either 32 or 64 characters long, depending on the presence of SecureRandom in the environment.

This changes `Rack::Protection::Base#random_string` to always output strings of 32 characters, ensuring that generated authenticity tokens will always have the same length (whether we're using `SecureRandom.hex` or `Kernel.rand`).

(See [here](https://github.com/rkh/rack-protection/pull/68#issuecomment-23970508) for more discussion.)