changed from Math.random to Crypto.randomBytes as the fallback