We could use a thread local secure random.  In practice, it will only happen once per session, not once per request. Only requests that accept HTML will have one generated, so you can make API calls avoid it too.