modify random value generation for csrf token to be crypto-secure (i.e., no more mt_rand() usage)