use secure random for secret token